CVE-2025-69374
Published: 20 February 2026
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-69374 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified under CWE-98 and labeled as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion. It affects the SolverWp Eleblog – Elementor Blog And Magazine Addons WordPress plugin (ele-blog), impacting all versions from n/a through 2.0.3. The vulnerability was published on 2026-02-20T16:22:21.717 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated remote attackers can exploit this vulnerability over the network without requiring user interaction, though exploitation demands high attack complexity. Successful attacks allow attackers to achieve high impacts on confidentiality, integrity, and availability, potentially enabling local file inclusion to read sensitive files or execute arbitrary code via PHP includes.
The Patchstack advisory provides details on this local file inclusion vulnerability in Eleblog – Elementor Blog And Magazine Addons plugin version 2.0.3, available at https://patchstack.com/database/Wordpress/Plugin/ele-blog/vulnerability/wordpress-eleblog-elementor-blog-and-magazine-addons-plugin-2-0-3-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is an unauthenticated local file inclusion (LFI) in a public-facing WordPress plugin, directly enabling exploitation of a public-facing application.