CVE-2025-49405

Name of the Vulnerable Software and Affected Versions Favethemes Pro Bulk Watermark Plugin for WordPress versions prior to 2.1 Houzez theme for WordPress versions prior to 4.1.2

Description Favethemes Pro Bulk Watermark Plugin for WordPress is subject to a path traversal issue, which occurs when an application uses user-supplied input to construct a pathname that is intended to be within a restricted directory, allowing access to files outside that directory.

The Houzez theme allows unauthenticated attackers to perform Local File Inclusion, a vulnerability where an application includes a file without properly validating the input, enabling the execution of arbitrary files on the server. This can lead to the execution of PHP code, bypassing of access controls, or the retrieval of sensitive data, particularly when images or other safe file types are uploaded and subsequently included.

Recommendations Update Favethemes Pro Bulk Watermark Plugin for WordPress to version 2.1 or later. Update Houzez theme for WordPress to version 4.1.2 or later.