CVE-2025-49295 is a high severity local file inclusion flaw (CVSS 8.1) in the MediClinic WordPress theme from Mikado-Themes, versions up to and including 2.1. A path traversal weakness lets PHP include files it should not. Patchstack lists 2.2 as the patched version.
What's affected
The record says MediClinic from Mikado-Themes is affected from n/a through 2.1. The Patchstack entry lists 2.1 and earlier as vulnerable and 2.2 as the patched version. The WordPress theme directory name is mediclinic.
Patchstack notes that the theme has no vulnerability disclosure program, so the vendor may not publish its own advisory. Treat the Patchstack entry and your update channel as the sources for the fix.
Two sibling themes from the same vendor have matching entries, CVE-2025-49296 for GrandPrix and CVE-2025-49297 for Grill and Chow, with the same weakness and the same score.
How to check if you're exposed
If you have command line access with WP-CLI, list your themes with versions and available updates:
wp theme list --fields=name,status,version,update
Look for mediclinic in the output and compare the version with 2.2. Inactive themes count too. A theme that is installed but not active can still have files that the web server will run, so remove ones you do not use.
Without WP-CLI, open the Appearance page in the WordPress dashboard and read the theme version, or check the version line in the style.css file of the theme folder under wp-content/themes.
grep -i "^Version" wp-content/themes/mediclinic/style.css
Also review web server logs for requests to this theme's files that contain sequences of dots and slashes in parameters.
What to do now
- Find every WordPress site that uses MediClinic, including staging and agency managed copies.
- Update to 2.2 or later. If you bought the theme through a marketplace, update through the channel you used to buy it.
- If you cannot update, switch to another theme, or remove the mediclinic folder if it is inactive.
- Back up files and the database before you change anything.
- Review access logs, and check the theme and uploads folders for files you did not add.
- Keep PHP and WordPress core on supported versions, and block direct web access to files that need none.
Why it matters
The record files this under CWE-35, path traversal using a pattern of dots and slashes. The theme builds a file path from input and does not clean it well enough, so the include statement can be pointed at other files on the server. The CVSS vector lists high attack complexity and no privileges required, which is why the score is 8.1 and not higher.
Local file inclusion can expose configuration files that hold database passwords, and in some setups it can be turned into code execution. Impact depends on server layout and on what files are readable. Patchstack rates it as expected to become exploited. This CVE is not on the CISA Known Exploited Vulnerabilities list, and I found no report of exploitation.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
My theme is installed but inactive. Am I safe?
Not necessarily. Inactive theme files stay on the server, and a web request can still reach them. Delete themes you do not use.
Where do I get the fix?
Patchstack lists 2.2 as the patched version. Update through the channel where you obtained the theme, and check the vendor page for notes.
Sources
Last reviewed: 18 October 2026.
