CVE-2025-49366: 
WordPress vulnerability analysis and mitigation

CVE-2025-49366 is a Local File Inclusion (LFI) vulnerability in the AncoraThemes Hanani WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the Hanani theme up to and including version 1.2.11, allowing unauthenticated remote attackers to include arbitrary local files via improper PHP filename control. The vulnerability was published on December 18, 2025, and assigned by Patchstack. It carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The root cause is CWE-98 — improper control of filenames passed to PHP include or require statements within the Hanani theme, enabling PHP Local File Inclusion. An attacker can manipulate user-supplied input that is passed unsanitized to a file inclusion function, causing the server to include arbitrary files from the local filesystem. Exploitation requires no authentication and no user interaction, though the attack complexity is rated High, suggesting some precondition (such as specific server configuration or parameter guessing) must be met. No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation allows a remote, unauthenticated attacker to read arbitrary files from the server's local filesystem, including sensitive configuration files (e.g., wp-config.php), credential stores, and system files such as /etc/passwd. This can expose database credentials, API keys, and server infrastructure details that could be leveraged for further compromise, privilege escalation, or lateral movement. The CVSS assessment rates confidentiality, integrity, and availability impacts all as High, indicating potential for significant data exposure and system disruption (Feedly).

As of the time of reporting, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.053%, reflecting a low current probability of exploitation in the near term. The attack requires no privileges or user interaction, but the High attack complexity rating suggests exploitation is not trivially straightforward (Feedly).

1. Reconnaissance: Identify WordPress sites using the Hanani theme (version ≤ 1.2.11) via passive techniques such as HTTP response headers, theme stylesheet references (/wp-content/themes/hanani/style.css), or tools like WPScan.
2. Identify vulnerable parameter: Analyze the theme's PHP source code or observed HTTP requests to locate parameters passed to include/require statements without proper sanitization.
3. Craft LFI payload: Construct a malicious HTTP request targeting the vulnerable parameter with a path traversal payload (e.g., ../../../../wp-config.php or /etc/passwd) to reference sensitive local files.
4. Send request: Submit the crafted GET or POST request to the vulnerable WordPress endpoint hosting the Hanani theme.
5. Extract sensitive data: Parse the server's HTTP response for the contents of the included file, extracting credentials, configuration details, or other sensitive information for further exploitation (Feedly).

• Network: Unusual HTTP requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters; requests targeting /wp-content/themes/hanani/ with unexpected file path values.
• Logs: Web server access logs showing requests with encoded or plaintext directory traversal strings; repeated 200 OK responses to requests referencing system files like wp-config.php or /etc/passwd.
• File System: No direct file system artifacts expected from read-only LFI, but monitor for follow-on activity such as new files written if chained with other vulnerabilities.
• Process: Unexpected PHP errors or warnings in server logs related to file inclusion failures, which may indicate probing attempts (Feedly).

The primary remediation is to update the Hanani WordPress theme to a version beyond 1.2.11, which addresses the improper file inclusion control. As interim workarounds, administrators should implement strict server-side input validation for any file inclusion mechanisms, apply whitelisting for permitted file paths, and restrict web server file system permissions to limit accessible directories. Deploying a Web Application Firewall (WAF) with rules to detect and block path traversal and LFI patterns is also recommended. Regularly monitor web application logs for suspicious file access attempts (Feedly, Patchstack).