The vulnerability CVE-2025-49070 affects the NasaTheme Elessi WordPress theme versions before 6.4.1. It is caused by improper validation or control of filenames used in PHP include or require statements, which leads to a Local File Inclusion vulnerability. This allows an attacker with limited privileges to include local files on the server, potentially executing arbitrary code or accessing sensitive information. The CVSS v3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is not related to remote file inclusion despite the title mentioning it; the description specifies local file inclusion. No patch links or vendor advisories are currently available, and no exploits are known in the wild.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized code execution, and disruption of service on affected installations of the Elessi theme. Because it allows local file inclusion, attackers may read configuration files, execute arbitrary PHP code, or escalate privileges. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor NasaTheme's official channels for updates. In the meantime, restricting access to vulnerable endpoints and applying web application firewall rules to block suspicious include/require requests may reduce risk. Avoid using affected versions of the Elessi theme in production environments until a fix is available.