CVE-2025-49364: WordPress Ludos Paradise theme <= 2.1.3 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Ludos Paradise ludos-paradise allows PHP Local File Inclusion.This issue affects Ludos Paradise: from n/a through <= 2.1.3.
Affected Software
Event History
Frequently Asked Questions
Which installations are affected?
AncoraThemes Ludos Paradise installations are affected through version 2.1.3. The available data does not identify a first affected version.
Does exploitation require an authenticated WordPress user or user interaction?
The CVSS vector indicates no privileges are required and no user interaction is required. The attack vector is network-based, although the vector also rates attack complexity as high.
What is the potential impact if exploitation succeeds?
The reported impact includes high confidentiality, integrity, and availability impact. The vulnerability is a PHP local file inclusion issue caused by improper control of a filename used in an include or require statement.