CVE-2025-26985
Published: 25 February 2025
Description
Adversaries may backdoor web servers with web shells to establish persistent access to systems.
Security Summary
CVE-2025-26985 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the Majestic Support WordPress plugin. This issue impacts all versions from n/a through 1.0.6. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and is associated with CWE-98.
Remote attackers require no privileges or user interaction but must overcome high attack complexity to exploit the flaw over the network. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing attackers to include and execute arbitrary local files on the server.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/majestic-support/vulnerability/wordpress-majestic-support-plugin-1-0-6-local-file-inclusion-vulnerability?_s_id=cve provides details on the vulnerability in the Majestic Support plugin version 1.0.6.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
LFI vulnerability in public-facing WordPress plugin enables remote exploitation of the application (T1190) and facilitates arbitrary local PHP file inclusion/execution, commonly used to load and run web shells (T1100).