CVE-2025-49886: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability (CVE-2025-49886) was discovered in WebGeniusLab Zikzag Core WordPress plugin affecting versions up to 1.4.5. The vulnerability was reported on May 25, 2025, and publicly disclosed on June 24, 2025. This security flaw stems from improper control of filename for Include/Require statements in PHP programs (Patchstack, NVD).

The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It has received a CVSS v3.1 base score of 8.1 (High), with the following vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability is network-accessible, requires no privileges or user interaction, but has high attack complexity. The potential impact on confidentiality, integrity, and availability is rated as high (Patchstack).

The vulnerability could allow an unauthenticated attacker to include local files of the target website and display their contents. This could potentially expose sensitive information, including database credentials, which might lead to complete database takeover depending on the system configuration (Patchstack).

Users are advised to update to version 1.4.6 or later to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking any attacks until users can update to a fixed version. The vulnerability requires immediate mitigation due to its high severity and potential for exploitation (Patchstack).