CVE-2025-49370: WordPress Lymcoin theme <= 1.3.12 - Local File Inclusion vulnerability
Published Dec 18, 2025
·Updated
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Lymcoin lymcoin allows PHP Local File Inclusion.This issue affects Lymcoin: from n/a through <= 1.3.12.
Affected Software
2 affected components
AncoraThemes Lymcoin<=1.3.12
WordPress Lymcoin theme<=1.3.12
Event History
Dec 18, 2025
CVE Published
via MITRE·07:21 AM
Data Sourced
via MITRE·07:21 AM
DescriptionSeverityWeakness
Data Sourced
via NVD·08:15 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
What is the severity of CVE-2025-49370?
CVE-2025-49370 is classified as a high severity vulnerability due to its potential for remote file inclusion.
2
How do I fix CVE-2025-49370?
To fix CVE-2025-49370, update the AncoraThemes Lymcoin to version 1.3.12 or later.
3
What types of attacks can CVE-2025-49370 enable?
CVE-2025-49370 can enable attackers to execute arbitrary PHP code through local file inclusion.
4
Which versions of Lymcoin are affected by CVE-2025-49370?
CVE-2025-49370 affects Lymcoin versions up to and including 1.3.12.
5
Is CVE-2025-49370 a concern for WordPress users?
Yes, CVE-2025-49370 affects the Lymcoin theme used in WordPress, making it a concern for WordPress users.