Improper Control of Filename Vulnerability in Elessi Theme by NasaTheme
CVE-2025-49070

7.5HIGH

Key Information:

Vendor

WordPress
Status
Elessi
Vendor
CVE Published:
4 July 2025

What is CVE-2025-49070?

The Elessi theme by NasaTheme has a vulnerability that stems from improper control of filenames in the PHP Include/Require statement, allowing for PHP Local File Inclusion. This flaw can potentially enable attackers to execute arbitrary PHP code on the server, compromising the integrity and security of the web application. Users of Elessi Theme should take immediate action to secure their installations and mitigate the risks associated with this vulnerability.

Affected Version(s)

Elessi < 6.4.1

References

https://patchstack.com/database/wordpress/theme/elessi-th...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Phat RiO - BlueRock (Patchstack Alliance)
.