Gardis Theme CVE-2025-49942

Exploitation requires the Gardis theme (versions up to and including 1.2.13) to be installed and active, and the attacker must reach the specific code path that passes unsanitized input into a PHP include/require statement. No authentication is required (PR:N) and no user interaction is needed (UI:N), but the CVSS AC:H reflects that converting the local file inclusion into the rated full code-execution/CIA impact depends on additional conditions - typically a writable or attacker-influenceable local path (log poisoning, an upload, or an available PHP stream wrapper) to be included and executed. Absent such a chainable local target, impact is more likely limited to local file disclosure.

This is a genuinely high-severity-rated flaw (CVSS 8.1) in a niche commercial WordPress theme, but the real-world urgency is tempered by several signals. The CVSS vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) shows remote, unauthenticated reachability with full CIA impact, which is why the base score is high. However, the AC:H (high attack complexity) is the decisive moderating factor: the attacker must satisfy non-trivial preconditions to turn a PHP include into actual code execution and full compromise. CWE-98 nominally covers Remote File Inclusion, but the description explicitly scopes the real behavior to PHP Local File Inclusion ('allows PHP Local File Inclusion'), meaning the C:H/I:H/A:H impact typically depends on an LFI-to-RCE chain (e.g. including a poisoned log file, an uploaded file, or a PHP wrapper) rather than straightforward remote code pull - note this CWE-vs-description tension. There is no EPSS score, no CISA KEV listing, and no public exploit provided, so this is 'no public exploit identified at time of analysis' rather than an actively-exploited priority. SSVC inputs (exploitation status, automatable, technical impact) are not supplied in the feed. Net: a real vulnerability worth patching, but current exploitation likelihood is low/unproven and the high CVSS is driven by worst-case impact assumptions rather than demonstrated in-the-wild use.

A remote, unauthenticated attacker identifies a Gardis theme endpoint that passes attacker-controlled input into a PHP include/require statement and supplies a crafted filename value to load a local file of their choosing. Because achieving the rated full impact requires chaining LFI to code execution (AC:H) - for example pointing the include at a log file or temporary upload seeded with PHP - successful exploitation is conditional rather than trivial. No public proof-of-concept exploit is identified at time of analysis.