Cyber Posture

CVE-2025-49361

High

Published: 18 December 2025

Published
18 December 2025
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Mamita mamita allows PHP Local File Inclusion.This issue affects Mamita: from n/a through <= 1.0.9.

Mitigating Controls (NIST 800-53 r5)AI

SI-2 Flaw Remediation good match
prevent

Timely remediation of the known PHP Local File Inclusion flaw in Mamita theme versions <=1.0.9 directly prevents exploitation by applying patches from advisories like Patchstack.

SI-10 Information Input Validation good match
prevent

Validates and sanitizes filenames used in PHP include/require statements to block malicious inputs enabling Local File Inclusion attacks.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Vulnerability scanning identifies the CVE-2025-49361 flaw in deployed WordPress themes, enabling proactive patching before exploitation.

Security SummaryAI

CVE-2025-49361 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, known as PHP Remote File Inclusion, that enables PHP Local File Inclusion in the AncoraThemes Mamita WordPress theme. This issue affects Mamita versions from n/a through 1.0.9. It is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impacts.

The vulnerability can be exploited by unauthenticated attackers with network access, though it requires high attack complexity and no user interaction. Exploitation allows attackers to perform local file inclusion, potentially leading to high confidentiality, integrity, and availability impacts, such as unauthorized access to sensitive files or system compromise on affected WordPress installations running the vulnerable theme.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/mamita/vulnerability/wordpress-mamita-theme-1-0-9-local-file-inclusion-vulnerability?_s_id=cve. The vulnerability was published on 2025-12-18.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is an improper filename control in a public-facing WordPress theme, enabling unauthenticated remote exploitation for local file inclusion and system compromise, directly mapping to T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References