CVE-2025-49369: WordPress Lettuce theme <= 1.1.7 - Local File Inclusion vulnerability
Published Dec 18, 2025
·Updated
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Lettuce lettuce allows PHP Local File Inclusion.This issue affects Lettuce: from n/a through <= 1.1.7.
Affected Software
2 affected components
AncoraThemes Lettuce<=1.1.7
WordPress Lettuce<=1.1.7
Event History
Dec 18, 2025
CVE Published
via MITRE·07:21 AM
Data Sourced
via MITRE·07:21 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Does exploitation require an authenticated WordPress account or user interaction?
No. The CVSS vector indicates no privileges are required and no user interaction is required.
2
How difficult is exploitation expected to be?
The CVSS vector rates attack complexity as high. The vulnerability is network-reachable and is rated as having high potential impact to confidentiality, integrity, and availability.