CVE-2025-49368: WordPress Palladio theme <= 1.1.10 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Palladio palladio allows PHP Local File Inclusion.This issue affects Palladio: from n/a through <= 1.1.10.
Affected Software
Event History
Frequently Asked Questions
What access or interaction does an attacker need to exploit this issue?
The CVSS vector indicates exploitation is network-accessible and does not require privileges or user interaction. The attack complexity is rated high.
Which installations are affected?
Palladio theme versions through 1.1.10 are affected. The available information does not state whether any particular WordPress configuration or theme feature must be enabled.
What is the potential impact if exploitation succeeds?
The CVSS assessment rates confidentiality, integrity, and availability impact as high. This indicates successful exploitation could have severe consequences across all three security properties.