CVE-2025-49941: 
WordPress vulnerability analysis and mitigation

CVE-2025-49941 is a Local File Inclusion (LFI) vulnerability in the AncoraThemes GlamChic WordPress theme, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the GlamChic theme up to and including 1.0.11, and can be exploited by unauthenticated remote attackers. The vulnerability was reported on August 5, 2025, and publicly disclosed by Patchstack on September 4, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability stems from improper handling of user-supplied input used in PHP include/require statements within the GlamChic theme (CWE-98), allowing an attacker to manipulate the filename parameter to include arbitrary local files from the server's filesystem. No authentication or user interaction is required, and the attack is conducted over the network with high attack complexity. The flaw is classified under OWASP Top 10 category A3: Injection, and was discovered by Tran Nguyen Bao Khanh of VCI - VNPT Cyber Immunity (Patchstack).

Successful exploitation allows an attacker to include and expose the contents of arbitrary local files on the web server, including sensitive configuration files such as WordPress wp-config.php, which contains database credentials. This can lead to complete database takeover, exposure of authentication secrets, and potentially further compromise of the hosting environment. Given that no authentication is required, the attack surface is broad and affects any WordPress site running the vulnerable theme version (Patchstack).

No official patch is currently available for this vulnerability, increasing the risk of exploitation. Patchstack rates this as high priority and notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or traffic. The EPSS score is approximately 0.053% (0.000530), indicating a currently low but non-negligible probability of exploitation in the near term. No specific threat actor attribution or confirmed in-the-wild exploitation has been reported at this time, and the vulnerability is not listed in the CISA KEV catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites using the GlamChic theme (version ≤ 1.0.11) via passive scanning tools (e.g., WPScan, Shodan) or by inspecting theme metadata in page source (/wp-content/themes/glamchic/style.css).
2. Identify vulnerable parameter: Locate the theme's PHP file(s) that accept user-controlled input for file inclusion, typically via a GET or POST parameter passed to a PHP include/require statement.
3. Craft LFI payload: Construct a request with a path traversal payload targeting sensitive files, such as ../../../../wp-config.php or /etc/passwd, in the vulnerable parameter.
4. Send malicious request: Submit the crafted HTTP request to the target WordPress site without any authentication.
5. Extract sensitive data: Review the server's response for the contents of the included file, extracting database credentials, secret keys, or other sensitive configuration data for further exploitation (Patchstack).

• Network: Unusual HTTP GET or POST requests to GlamChic theme endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters; requests targeting sensitive file paths such as wp-config.php or /etc/passwd.
• Logs: WordPress or web server access logs showing repeated requests with path traversal patterns to theme-related PHP files; HTTP 200 responses to requests containing file inclusion payloads.
• File System: No new files expected from LFI alone, but monitor for subsequent web shell uploads or unauthorized file modifications following credential theft.
• Application: Unexpected database connection attempts from new IP addresses, potentially indicating use of stolen wp-config.php credentials (Patchstack).

As of the disclosure date, no official patch has been released by AncoraThemes for the GlamChic theme. Site administrators are advised to remove or deactivate the GlamChic theme immediately if possible, or switch to an alternative theme. Patchstack has issued a virtual patching/mitigation rule for subscribers that blocks exploitation attempts until an official fix is available. Web application firewalls (WAFs) should be configured to block path traversal patterns in HTTP requests as an interim measure (Patchstack).