The vulnerability CVE-2025-49363 in AncoraThemes Kings & Queens arises from improper control of the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This flaw allows an attacker to manipulate the filename input to include unintended local files on the server. The affected versions are up to 1.1.16. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix information is currently available, and no known exploits have been documented. The vulnerability is not related to a cloud service, so remediation requires vendor or user intervention.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server or potentially execute arbitrary code depending on the included files. This impacts confidentiality, integrity, and availability of the affected system. The high CVSS score (8.1) reflects the severity of these impacts. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor AncoraThemes communications for updates. Until a fix is available, restricting access to vulnerable endpoints and validating or sanitizing input parameters related to file inclusion may reduce risk.