CVE-2025-49370: 
WordPress vulnerability analysis and mitigation

CVE-2025-49370 is a PHP Local File Inclusion (LFI) vulnerability in the Lymcoin WordPress theme developed by AncoraThemes. The flaw stems from improper control of filename parameters used in PHP include/require statements, allowing remote attackers to access unauthorized local files on the server. All versions of the Lymcoin theme up to and including 1.3.12 are affected. The vulnerability was published on December 18, 2025, and carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The root cause is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The vulnerability arises when user-supplied input is passed unsanitized into PHP file inclusion functions (include or require), enabling an attacker to manipulate the filename parameter to reference arbitrary local files on the server. Exploitation is network-based, requires no authentication or user interaction, but is rated High complexity (AC:H), suggesting some precondition or constraint must be met — such as a specific request structure or parameter value — to successfully trigger the inclusion (Feedly). No public proof-of-concept code has been identified at this time.

Successful exploitation allows an attacker to read sensitive local files on the web server, including configuration files that may contain database credentials, API keys, or other secrets. Depending on server configuration (e.g., if PHP wrappers or log poisoning techniques are applicable), arbitrary code execution may also be achievable, leading to full server compromise. The vulnerability has high impact on confidentiality, integrity, and availability, and could serve as a stepping stone for lateral movement within a hosting environment (Feedly).

There is currently no public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The CVE was assigned and disclosed by Patchstack on December 18, 2025 (Feedly, Patchstack).

The primary remediation is to update the Lymcoin WordPress theme to a version newer than 1.3.12. Site administrators should apply the update immediately via the WordPress dashboard or by manually replacing the theme files. As interim mitigations, consider deploying a Web Application Firewall (WAF) with rules targeting LFI patterns, implementing strict server-side input validation and allow-lists for file inclusion paths, and restricting file system permissions to limit the files accessible by the web server process (Feedly, Patchstack).