CVE-2025-49943
Published: 18 December 2025
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Femme femme allows PHP Local File Inclusion.This issue affects Femme: from n/a through <= 1.3.11.
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the inadequate validation of filenames in PHP include/require statements, preventing LFI by enforcing input sanitization and path restrictions.
Mandates timely remediation of the specific flaw in the Femme WordPress theme through patching or updates to eliminate the vulnerability.
Enforces secure PHP configuration settings such as open_basedir to restrict file paths exploitable via LFI attacks.
Security SummaryAI
CVE-2025-49943 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion (LFI), in the AncoraThemes Femme WordPress theme. This flaw affects all versions of the Femme theme from its initial release through version 1.3.11. The vulnerability stems from inadequate validation of filenames used in PHP include/require statements, allowing malicious input to reference local files on the server.
Remote, unauthenticated attackers (AV:N/PR:N) can exploit this vulnerability over the network, though it requires high attack complexity (AC:H) and no user interaction (UI:N). Successful exploitation grants high-impact access to confidentiality, integrity, and availability (C:H/I:H/A:H) with unchanged scope (S:U), potentially enabling attackers to read sensitive local files, execute arbitrary code, or disrupt server operations via LFI techniques common in PHP environments.
The Patchstack advisory provides details on this vulnerability in the Femme WordPress theme, including assessment and recommended actions; practitioners should consult https://patchstack.com/database/Wordpress/Theme/femme/vulnerability/wordpress-femme-theme-1-3-11-local-file-inclusion-vulnerability?_s_id=cve for mitigation guidance, such as updating to a patched theme version if available.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a PHP LFI/RFI in a public-facing WordPress theme, enabling unauthenticated remote attackers to include and execute arbitrary local PHP files over the network, directly facilitating T1190: Exploit Public-Facing Application.