Cyber Posture

CVE-2025-25109

High

Published: 03 March 2025

Published
03 March 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0156 81.6th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-25109 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified under CWE-98 and described as enabling PHP Local File Inclusion in the JoomSky WP Vehicle Manager (js-vehicle-manager) WordPress plugin. This issue affects all versions from n/a through 3.1 inclusive. Published on 2025-03-03T14:15:50.907, it carries a CVSS v3.1 base score of 8.1 (High) with the vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H.

Unauthenticated attackers can exploit this vulnerability remotely over the network without requiring user interaction, though exploitation demands high attack complexity. Successful attacks can achieve high impacts on confidentiality, integrity, and availability, allowing inclusion and potential execution of arbitrary local PHP files on the server.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/js-vehicle-manager/vulnerability/wordpress-embed-rss-plugin-3-1-arbitrary-shortcode-execution-vulnerability-3?_s_id=cve.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The CVE describes a remote unauthenticated LFI vulnerability in a public-facing WordPress plugin allowing inclusion and execution of arbitrary local PHP files, directly enabling exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References