PHP CVE-2025-49253

The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP security flaw where user-supplied input is passed unsanitized to PHP's include(), require(), include_once(), or require_once() functions. In thembay Lasa, likely a WordPress theme or plugin (vendor: thembay), an attacker can manipulate filename parameters to load arbitrary files from the local filesystem. While initially described as 'PHP Remote File Inclusion,' the description clarifies this is actually a Local File Inclusion (LFI) vulnerability. An attacker could exploit this to read sensitive files (e.g., wp-config.php, /etc/passwd), or if combined with file upload or log poisoning techniques, achieve remote code execution. The affected product is thembay Lasa versions from an unspecified baseline through version 1.1.