CVE-2025-49405
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The Houzez theme for WordPress is vulnerable to PHP Local File Inclusion due to improper control of filenames in include/require statements. This affects versions before 4.1.4.
Risk Assessment
An attacker could include local server files, potentially leading to data disclosure or code execution depending on configuration.
Recommendation
Update the Houzez theme to version 4.1.4 or later.
Other vulnerabilities in Houzez
See all- CVE-2026-96339High
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Houzez.co Houzez allows Reflected XSS. This issue affects Houzez: from n/a through 4.4.0.
- CVE-2025-9191Medium
The Houzez theme for WordPress is vulnerable to PHP Object Injection in all versions up to and including 4.1.6 via deserialization of untrusted input in saved-search-item.php. This allows authenticated attackers with Subscriber-level access and above to inject a PHP Object. No known POP chain is present in the vulnerable software, meaning this vulnerability has no impact unless another plugin or theme containing a POP chain is installed. If a POP chain is present, it may allow the attacker to perform actions like deleting arbitrary files, retrieving sensitive data, or executing code.
- CVE-2025-49952Medium
An authorization bypass through a user-controlled key vulnerability in the favethemes Houzez plugin allows exploitation of incorrectly configured access control security levels. This issue affects Houzez versions up to and including 4.2.5.
Original NVD description (English source)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Favethemes Houzez allows PHP Local File Inclusion.This issue affects Houzez: from n/a before 4.1.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS