Palladio Theme CVE-2025-49368

Exploitation targets sites running the AncoraThemes Palladio WordPress theme at version 1.1.10 or earlier. Per the CVSS vector, no authentication (PR:N) and no user interaction (UI:N) are required, and the attack is network-reachable (AV:N). The limiting factor is the HIGH attack complexity (AC:H): reaching full impact typically requires a valid include path and, for code execution rather than mere file disclosure, an attacker-controllable local file (uploaded content, log, or session file) to be included. Realistic risk is further bounded by the theme's niche deployment footprint and the absence of any observed exploitation.

This is a CWE-98 PHP file-inclusion flaw (LFI) in the AncoraThemes 'Palladio' WordPress theme, versions up to and including 1.1.10. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, score 8.1) indicates a network-reachable, unauthenticated vulnerability with full CIA impact but HIGH attack complexity, which is what pulls the score below 9.0. The AC:H is significant: Patchstack-class LFI issues frequently require a specific include path, parameter manipulation, or the presence of a poisonable/uploadable local file to escalate to code execution, meaning exploitation is not a trivial single request. No EPSS score, no CISA KEV listing, and no public POC are present in the supplied data, so there is 'no public exploit identified at time of analysis.' The tag set marks this as 'Information Disclosure,' which understates the vector - with I:H/A:H and CWE-98, this is a file-inclusion issue that can plausibly reach code execution if an attacker can control included file content, not merely read files. Net assessment: genuinely high-severity by impact, but real-world urgency is tempered by HIGH attack complexity, the niche theme footprint, and the complete absence of exploitation signals (no KEV, no EPSS, no POC).

A remote unauthenticated attacker crafts a request to a theme endpoint that passes attacker-influenced input into a PHP include/require statement, causing a local file to be included and executed. If the attacker can also stage controllable content on the server (e.g., a log, upload, or session file), the local inclusion can be leveraged toward PHP code execution; otherwise it exposes sensitive local files. No public exploit code is identified in the available data.