CVE-2025-49362: WordPress Gracioza theme <= 1.0.15 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Gracioza gracioza allows PHP Local File Inclusion.This issue affects Gracioza: from n/a through <= 1.0.15.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
Gracioza theme installations are affected through version 1.0.15. The available data does not identify a fixed version or any configuration conditions that would exclude an installation.
Does an attacker need an account or user interaction to exploit this?
The CVSS vector indicates no privileges are required and no user interaction is required. Exploitation is network-accessible, although the attack complexity is rated high.
What impact could successful exploitation have?
The vulnerability is rated high severity with high impacts to confidentiality, integrity, and availability. This indicates successful exploitation could expose data, alter data, and disrupt service.