PHP Local File Inclusion Vulnerability in thembay Greenmart
CVE-2025-49883

8.1HIGH

Key Information:

Vendor

WordPress
Status
Greenmart
Vendor
CVE Published:
27 June 2025

What is CVE-2025-49883?

The thembay Greenmart theme is vulnerable to a PHP Local File Inclusion (LFI) flaw, allowing unauthorized access to local files on the server. This vulnerability arises from improper control of filename parameters in include or require statements within the theme's PHP code. As a result, attackers could exploit this issue to execute malicious scripts, potentially leading to further compromise of the server or user data theft. It is crucial for users running affected versions of Greenmart to apply necessary security patches to mitigate this risk.

Affected Version(s)

Greenmart <= 4.2.3

References

https://patchstack.com/database/wordpress/theme/greenmart...
vdb-entry

CVSS V3.1

Score:
8.1
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) (Patchstack Alliance)
.
CVE-2025-49883 : PHP Local File Inclusion Vulnerability in thembay Greenmart