CVE-2025-49365: WordPress Jack Well theme <= 1.0.14 - Local File Inclusion vulnerability
Published Dec 18, 2025
·Updated
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Jack Well jack-well allows PHP Local File Inclusion.This issue affects Jack Well: from n/a through <= 1.0.14.
Affected Software
2 affected components
AncoraThemes Jack Well<=1.0.14
wordpress/jack-well<=1.0.14
Event History
Dec 18, 2025
CVE Published
via MITRE·07:21 AM
Data Sourced
via MITRE·07:21 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations should be prioritized for review?
Jack Well installations running version 1.0.14 or earlier are affected. The available data does not identify a fixed version.
2
Does exploitation require an authenticated WordPress account or user interaction?
No. The CVSS vector indicates no privileges are required and no user interaction is required, although exploitation has high attack complexity.
3
What is the potential impact if the issue is exploited?
The vulnerability is rated high severity with high impacts to confidentiality, integrity, and availability. It allows PHP local file inclusion.