The vulnerability CVE-2025-49360 affects the AncoraThemes Militarology WordPress theme (versions up to 1.0.15). It is caused by improper control of the filename parameter in PHP include or require statements, which leads to a Local File Inclusion vulnerability. This allows an attacker to include files from the local filesystem, potentially executing arbitrary code or accessing sensitive information. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or official fix is currently documented, and no known exploits have been reported in the wild.

Successful exploitation of this vulnerability can lead to local file inclusion, enabling attackers to execute arbitrary code or access sensitive files on the affected server. This compromises the confidentiality, integrity, and availability of the system running the Militarology theme. Given the high CVSS score (8.1), the impact is considered severe. However, no active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected theme to mitigate risk. Monitor official AncoraThemes communications for updates and apply patches promptly once released.