CVE-2025-49363: WordPress Kings & Queens theme <= 1.1.16 - Local File Inclusion vulnerability
Published Dec 18, 2025
·Updated
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Kings & Queens kings-queens allows PHP Local File Inclusion.This issue affects Kings & Queens: from n/a through <= 1.1.16.
Affected Software
2 affected components
AncoraThemes Kings & Queens<=1.1.16
WordPress Kings & Queens theme<=1.1.16
Event History
Dec 18, 2025
CVE Published
via MITRE·07:21 AM
Data Sourced
via MITRE·07:21 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an account or user interaction?
No. The CVSS vector indicates no privileges are required and no user interaction is required.
2
What level of impact could successful exploitation have?
The CVSS vector rates confidentiality, integrity, and availability impact as high.
3
Is the issue remotely reachable?
The CVSS vector lists network attack access, although it also rates attack complexity as high.