Platform
wordpress
Component
litho
Fixed in
3.0.1
CVE-2025-49879 describes an Arbitrary File Access vulnerability within the themezaa Litho WordPress theme. This flaw allows attackers to potentially read arbitrary files on the server by manipulating file paths. The vulnerability impacts versions of Litho from 0.0.0 through 3.0, and a patch is available in version 3.0.1.
The Arbitrary File Access vulnerability in Litho allows an attacker to bypass intended access controls and read files outside of the intended directory. This could expose sensitive information such as configuration files, database credentials, or even source code. Successful exploitation could lead to complete compromise of the WordPress site and potentially the underlying server. The attacker could gain access to critical data, modify website content, or install malicious code. This vulnerability shares similarities with other path traversal exploits, where attackers leverage '..' sequences to navigate the file system.
CVE-2025-49879 was publicly disclosed on 2025-06-17. There is no indication of this vulnerability being actively exploited at this time. The EPSS score is pending evaluation. No public proof-of-concept exploits have been identified as of the disclosure date.
Exploit Status
EPSS
0.10% (26% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2025-49879 is to immediately upgrade the Litho WordPress theme to version 3.0.1 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (e.g., '../'). Additionally, restrict file permissions on sensitive directories to prevent unauthorized access. Regularly review WordPress plugin and theme updates to proactively address potential vulnerabilities.
Actualice el tema Litho a una versión corregida. Verifique el sitio web del desarrollador o el repositorio de WordPress para obtener la última versión disponible. Como no se especifica una versión corregida en el CVE, contacte al desarrollador para obtener más información.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2025-49879 is a HIGH severity vulnerability in the Litho WordPress theme allowing attackers to read arbitrary files via path traversal. It affects versions 0.0.0–3.0.
You are affected if your WordPress site uses the Litho theme and is running version 3.0 or earlier. Upgrade to 3.0.1 to resolve the issue.
Upgrade the Litho WordPress theme to version 3.0.1 or later. As a temporary workaround, implement a WAF rule to block path traversal attempts.
There is currently no indication that CVE-2025-49879 is being actively exploited, but it's crucial to apply the patch promptly.
Refer to the themezaa website or WordPress plugin repository for the official advisory and update information regarding CVE-2025-49879.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.