CVE-2025-49371: 
WordPress vulnerability analysis and mitigation

CVE-2025-49371 is a PHP Local File Inclusion (LFI) vulnerability in the Strux WordPress theme by AncoraThemes. It stems from improper control of filename parameters used in PHP include/require statements (CWE-98), allowing unauthenticated remote attackers to include arbitrary local files on the server. All versions of the Strux theme up to and including version 1.9 are affected. The vulnerability was published on December 18, 2025, and carries a CVSS v3.1 base score of 8.1 (High) (Feedly, Patchstack).

The root cause is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), where user-supplied input is passed unsanitized to a PHP file inclusion function within the Strux theme. An unauthenticated attacker can craft a network request that manipulates the filename parameter to point to sensitive local files on the server, bypassing intended access controls. Exploitation requires high attack complexity (e.g., specific preconditions such as particular server configurations or race conditions), but no authentication or user interaction is needed. No public proof-of-concept code has been identified at this time (Feedly, Patchstack).

Successful exploitation of this LFI vulnerability could allow an attacker to read sensitive system files (e.g., /etc/passwd, WordPress wp-config.php containing database credentials), access confidential configuration data, and potentially execute unauthorized code on the server if file upload or log poisoning techniques are chained. The confidentiality, integrity, and availability impacts are all rated High, meaning a complete compromise of the affected WordPress installation is possible. Lateral movement within the hosting environment or access to adjacent applications sharing the same server is also a risk if sensitive credentials are exposed (Feedly).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. The vulnerability was reported and assigned by Patchstack (Feedly, Patchstack).

1. Reconnaissance: Identify WordPress sites using the Strux theme (version ≤ 1.9) via passive fingerprinting tools (e.g., WhatCMS, Wappalyzer, or Shodan queries for WordPress theme headers).
2. Identify vulnerable parameter: Analyze the Strux theme's PHP source code or HTTP responses to locate the file inclusion parameter that accepts user-controlled input without sanitization.
3. Craft malicious request: Send a crafted HTTP GET or POST request to the vulnerable endpoint, supplying a path traversal payload (e.g., ../../../../etc/passwd or ../../../../wp-config.php) as the filename parameter.
4. Read sensitive files: If successful, the server returns the contents of the targeted local file, exposing credentials, configuration data, or other sensitive information.
5. Escalate (optional): Chain the LFI with a log poisoning or file upload technique to achieve remote code execution if the server configuration permits PHP execution of included files (Feedly).

• Network: Unusual HTTP requests to WordPress theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields.
• Logs: Web server access logs (Apache/Nginx) showing requests with encoded traversal strings targeting theme-related PHP files; HTTP 200 responses to requests with suspicious filename parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or server log files by the web server process.
• Process: PHP error logs showing failed include()/require() calls with unusual file paths, which may indicate probing attempts.

The primary remediation is to update the Strux WordPress theme to a version beyond 1.9 that includes a patch for this vulnerability. If no patched version is yet available from AncoraThemes, site administrators should consider deactivating and removing the vulnerable theme until a fix is released. As interim mitigations, implement strict server-side input validation for any file inclusion parameters, use allowlists to restrict permissible file paths, and deploy a Web Application Firewall (WAF) configured to block path traversal and file inclusion patterns. Applying the principle of least privilege to the web server process can also limit the impact of successful exploitation (Feedly, Patchstack).