LT Unleashed CVE-2025-13886

Requires an authenticated WordPress account with Contributor-level capability or higher (PR:L) on a site with the LT Unleashed plugin (≤1.1.1) active. Exploitation is performed by supplying a path-traversal value to the 'template' parameter of the book shortcode; achieving code execution (versus mere file disclosure) additionally requires an attacker-includable PHP file on the server - e.g., via a prior upload or log poisoning - which is why the vendor assigned AC:H. Limiting factors: the Contributor authentication barrier, the AC:H complexity of staging an executable file, and the plugin's low deployment footprint. Sites that do not grant Contributor accounts to untrusted users are not practically exposed.

This is a genuine but access-gated risk. The CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H = 7.5 High) shows a network-reachable flaw with full CIA impact, but two dampeners matter: PR:L means the attacker must already hold at least Contributor-level WordPress credentials, and AC:H (assigned by Wordfence) reflects that turning a Local File Inclusion into actual code execution is not trivial - it typically requires a separately includable PHP file, log poisoning, or the ability to reach wp-config.php. No EPSS score, CISA KEV entry, or public POC was provided, so there is no evidence of active exploitation or automated weaponization; treat exploitation status as 'no public exploit identified at time of analysis.' The 7.5 rating is credible rather than inflated, but the Contributor-authentication prerequisite plus AC:H keeps real-world urgency at moderate for the small population of sites running this plugin. Prioritize patching where untrusted users can obtain Contributor accounts (multi-author blogs, membership sites); deprioritize on single-author installs where no low-trust accounts exist.

An attacker registers or obtains a Contributor-level account on a WordPress site running LT Unleashed ≤1.1.1, then embeds the book shortcode in a post/preview with a malicious template parameter that path-traverses to an attacker-controlled or already-poisoned file (e.g., an uploaded file or a poisoned log). When the shortcode renders, the plugin includes and executes that file as PHP, or discloses wp-config.php contents. No public POC was provided, and the AC:H rating reflects that achieving reliable code execution requires an includable payload file rather than a single unconditional request.