CVE-2025-49366: WordPress Hanani theme <= 1.2.11 - Local File Inclusion vulnerability
Published Dec 18, 2025
·Updated
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Hanani hanani allows PHP Local File Inclusion.This issue affects Hanani: from n/a through <= 1.2.11.
Affected Software
1 affected component
AncoraThemes Hanani<=1.2.11
Event History
Dec 18, 2025
CVE Published
via MITRE·07:21 AM
Data Sourced
via MITRE·07:21 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which deployments are affected?
AncoraThemes Hanani installations are affected through version 1.2.11. The available information does not identify an unaffected fixed version.
2
Does exploitation require an authenticated WordPress account or user interaction?
No. The CVSS vector indicates no privileges are required and no user interaction is required. The attack vector is network-based, although exploitation has high attack complexity.
3
What could a successful attacker achieve?
Successful exploitation can affect confidentiality, integrity, and availability at a high impact level, according to the CVSS metrics.