What is the CVSS score of CVE-2025-49297?

CVE-2025-49297 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-49297?

A high-severity path traversal vulnerability in Mikado-Themes Grill and Chow WordPress themes allows attackers to read arbitrary files from affected servers through PHP Local File Inclusion.

How to fix or mitigate CVE-2025-49297?

Within 24 hours: inventory all WordPress installations using Grill or Chow themes versions 1.6 and below; isolate affected sites from production if business-critical. Within 7 days: implement WAF rules blocking suspicious path traversal patterns, apply input validation, and disable theme functionality if not essential. Within 30 days: migrate to alternative themes or contact vendor for patch availability; conduct file access audit on affected servers to detect potential compromise.

PHP CVE-2025-49297

EUVD-2025-17551 HIGH

Path Traversal: '.../...//' (CWE-35)

2025-06-09 audit@patchstack.com

PHP Path Traversal

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:42 NVD

CRITICAL HIGH

CVSS changed

Apr 23, 2026 - 15:42 NVD

9.8 (CRITICAL) 8.1 (HIGH)

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17551

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Path Traversal vulnerability in Mikado-Themes Grill and Chow allows PHP Local File Inclusion. This issue affects Grill and Chow: from n/a through 1.6.

AnalysisAI

Path traversal vulnerability in Mikado-Themes Grill and Chow WordPress themes (versions through 1.6) that enables PHP Local File Inclusion (LFI) attacks. An unauthenticated remote attacker can exploit this vulnerability to read arbitrary files on the affected server, potentially exposing sensitive configuration files, database credentials, and other confidential data. The high CVSS score of 8.1 reflects significant impact on confidentiality and integrity, though exploitation requires higher attack complexity.

Technical ContextAI

This vulnerability exploits improper input validation in file path handling within the Grill and Chow theme codebase. The root cause is classified under CWE-35 (Path Traversal), which occurs when user-controlled input is used to construct file paths without adequate sanitization or validation. Attackers can inject path traversal sequences (e.g., '../../../') to navigate outside intended directories and include arbitrary files via PHP inclusion functions (include(), require(), file_get_contents(), etc.). The vulnerability affects WordPress theme components that handle file operations, likely in template loading, asset inclusion, or custom functionality handlers. CPE identification points to Mikado-Themes products, specifically the Grill and Chow theme distribution across WordPress installations running affected versions.