What is the CVSS score of CVE-2025-49361?

CVE-2025-49361 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Mamita Theme are affected by CVE-2025-49361?

Organizations using the Mamita WordPress theme (versions 1.0.9 or earlier) by AncoraThemes face a high-severity vulnerability that could allow attackers to steal database credentials and compromise…

How to fix or mitigate CVE-2025-49361?

Within 24 hours: identify all WordPress sites using the Mamita theme (≤v1.0.9) and immediately remove it, replacing with an actively maintained alternative; note that no public exploit identified at time of analysis, but technical risk warrants urgent action. Within 7 days: if temporary theme retention is unavoidable due to business constraints, implement Web Application Firewall (WAF) rules to block path-traversal attacks, disable PHP's allow_url_include directive in php.ini, and restrict file-system permissions on wp-config.php and credential storage directories. Within 30 days: No vendor-released patch identified at time of analysis-continue monitoring AncoraThemes communication channels for security updates; conduct comprehensive security audits of any systems that ran the vulnerable theme to detect prior unauthorized access; establish theme governance policy requiring only vendors with transparent security practices and documented patch records.

Mamita Theme CVE-2025-49361

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-18 audit@patchstack.com

PHP WordPress Information Disclosure LFI Wordpress Theme

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.1 HIGH

Network-reachable without auth but specific conditions required (AC:H); full-chain RCE potential via LFI chaining supports C:H/I:H/A:H.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 26, 2026 - 17:02 vuln.today

CVE Published

Dec 18, 2025 - 08:15 cve.org

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Mamita mamita allows PHP Local File Inclusion.This issue affects Mamita: from n/a through <= 1.0.9.

AnalysisAI

Local File Inclusion in the Mamita WordPress theme (AncoraThemes, versions ≤ 1.0.9) exposes sites to unauthenticated path-traversal attacks where unsanitized input is passed directly to a PHP include() or require() call, enabling inclusion of arbitrary server-local files. Under the right server conditions, this can expose sensitive configuration files such as wp-config.php and escalate to remote code execution through techniques like log poisoning; the CVSS scorer's C:H/I:H/A:H ratings reflect this full-chain potential. No public exploit code has been identified and EPSS probability is 0.08% (23rd percentile), indicating low opportunistic exploitation risk at this time.

Technical ContextAI

The vulnerability resides in the Mamita WordPress theme published by AncoraThemes and is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). Although CWE-98 carries the label 'PHP Remote File Inclusion,' the exploitable condition here is specifically Local File Inclusion (LFI): user-controlled input reaches a PHP include() or require() call without adequate path sanitization, permitting inclusion of server-local files rather than remote URLs. In WordPress themes, vulnerable sinks of this type commonly appear in template loader functions, AJAX handlers accessible to unauthenticated visitors, or theme option processors that accept dynamic file path parameters. The vulnerability is confined to WordPress installations running the Mamita theme in versions up to and including 1.0.9, as confirmed by Patchstack (audit@patchstack.com).

Affected ProductsAI

The affected product is the Mamita WordPress theme by AncoraThemes, all versions from initial release through and including version 1.0.9. No CPE string is provided in the available data. The Patchstack advisory documenting the issue is available at https://patchstack.com/database/Wordpress/Theme/mamita/vulnerability/wordpress-mamita-theme-1-0-9-local-file-inclusion-vulnerability.

RemediationAI

Update the Mamita theme to any version above 1.0.9 once AncoraThemes releases a patched version; the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/mamita/vulnerability/wordpress-mamita-theme-1-0-9-local-file-inclusion-vulnerability should be monitored for a confirmed fix version, as none is identified in currently available data. If no patch is yet available and the theme cannot be replaced, deploying a WAF rule to block path-traversal patterns (../, php://filter, /etc/passwd, php://input) in query and POST parameters reduces exploitation likelihood with minimal application impact. Configuring PHP's open_basedir directive to restrict accessible filesystem paths limits the files reachable via include(), directly constraining LFI impact; the trade-off is potential breakage of legitimate theme file-loading logic. Verify that PHP's allow_url_include is disabled (it is off by default in modern PHP) to prevent any LFI from being escalated to remote file inclusion. Protecting server log files from being web-reachable and ensuring PHP cannot read them via open_basedir closes the most common LFI-to-RCE escalation path.