Cyber Posture

CVE-2025-27272

High

Published: 24 February 2025

Published
24 February 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0085 75.0th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.

Security Summary

CVE-2025-27272 is an Improper Control of Filename for Include/Require Statement vulnerability, classified as a PHP Remote File Inclusion issue but enabling PHP Local File Inclusion (LFI), in the vinagecko VG PostCarousel (vg-postcarousel) WordPress plugin. This flaw affects all versions of the plugin up to and including 1.1, stemming from CWE-98. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), reflecting network accessibility with high attack complexity.

Low-privileged authenticated users (PR:L) can exploit this vulnerability over the network without user interaction. Successful exploitation allows attackers to include and execute arbitrary local files on the server, potentially leading to high-impact confidentiality, integrity, and availability compromises, such as unauthorized data access or server-side code execution depending on file availability and server configuration.

Patchstack's advisory at https://patchstack.com/database/Wordpress/Plugin/vg-postcarousel/vulnerability/wordpress-vg-postcarousel-plugin-1-1-local-file-inclusion-vulnerability?_s_id=cve details the vulnerability and recommends updating to a patched version beyond 1.1 or removing the plugin if no update is available.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1059 Command and Scripting Interpreter Execution
Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries.
attack.mitre.org →
Why these techniques?

Vulnerability in public-facing WordPress plugin allows LFI leading to arbitrary file inclusion and potential server-side code execution; directly facilitates exploitation of public-facing apps for access (T1190), privilege escalation from low-priv authenticated users (T1068), and command/script execution via included PHP files (T1059).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

References