CVE-2025-69375
Published: 20 February 2026
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-69375 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion, affecting the SolverWp Portfolio Builder (swp-portfolio) WordPress plugin. This flaw impacts versions from n/a through 1.2.5 and is associated with CWE-98. The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for significant impact despite elevated complexity.
Remote, unauthenticated attackers can exploit this vulnerability over the network without requiring user interaction. Exploitation demands high attack complexity but can result in high confidentiality, integrity, and availability impacts, allowing attackers to include and potentially execute arbitrary local files on the server.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/swp-portfolio/vulnerability/wordpress-portfolio-builder-plugin-1-2-5-local-file-inclusion-vulnerability?_s_id=cve) documents this Local File Inclusion vulnerability in WordPress Portfolio Builder plugin version 1.2.5.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a local file inclusion (LFI) flaw in a public-facing WordPress plugin, directly enabling exploitation of public-facing applications for initial access and potential remote code execution or sensitive data disclosure.