CVE-2025-49296

CRITICAL 9.8CVE-2025-49296 · Published 09/06/2025 · updated 17/06/2026

Package	Affected versions	Patched versions
grandprix qodeinteractive	`< 1.6.1`	`1.6.1`

Description

Path Traversal: '.../...//' vulnerability in Mikado-Themes GrandPrix grandprix allows PHP Local File Inclusion.This issue affects GrandPrix: from n/a through <= 1.6.

References

patchstack.com/database/Wordpress/Theme/grandprix/vulnerability/wordpress-grandprix-1-6-local-file-inclusion-vulnerability · Third Party Advisory

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free