CVE-2025-49942
Published: 18 December 2025
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Gardis gardis allows PHP Local File Inclusion.This issue affects Gardis: from n/a through <= 1.2.13.
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the CVE by identifying, reporting, and applying the patch to fix the improper filename control in the Gardis theme's PHP include/require statements.
Requires validation of filename inputs to PHP include/require functions, preventing arbitrary local file inclusion by unauthenticated attackers.
Enforces secure PHP configuration settings like open_basedir to restrict file access paths, limiting the impact of flawed include statements.
Security SummaryAI
CVE-2025-49942 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion, within the AncoraThemes Gardis WordPress theme. The flaw enables PHP Local File Inclusion and affects all versions of Gardis from n/a through 1.2.13. It is associated with CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to network accessibility and significant impacts on confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely over the network with high attack complexity, requiring no user privileges or interaction. Successful exploitation allows arbitrary local file inclusion via manipulated PHP include/require statements, potentially leading to high-impact outcomes such as unauthorized access to sensitive files, code execution, data modification, or denial of service.
The Patchstack advisory provides details on this WordPress Gardis theme vulnerability, accessible at https://patchstack.com/database/Wordpress/Theme/gardis/vulnerability/wordpress-gardis-theme-1-2-13-local-file-inclusion-vulnerability?_s_id=cve, which likely includes mitigation guidance such as updating to a patched version beyond 1.2.13.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote/local file inclusion (RFI/LFI) in a public-facing WordPress theme, directly enabling exploitation of public-facing applications for initial access, sensitive file disclosure, or arbitrary code execution.