What is the CVSS score of CVE-2025-25109?

CVE-2025-25109 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of WP Vehicle Manager are affected by CVE-2025-25109?

WP Vehicle Manager plugin versions 3.1 and earlier contain a local file inclusion vulnerability (CVSS 8.1) that could allow unauthenticated attackers to read sensitive server files or execute…

How to fix or mitigate CVE-2025-25109?

Within 24 hours: Audit all WordPress installations for WP Vehicle Manager plugin presence and document affected versions. Within 7 days: Disable or remove WP Vehicle Manager 3.1 and earlier until patched version available; if critical to operations, isolate affected WordPress environment from production systems and restrict access to administrator users only. Within 30 days: Establish monitoring for plugin updates and security advisories; evaluate alternative vehicle management solutions or contact plugin vendor for patch timeline.

WP Vehicle Manager CVE-2025-25109

HIGH

PHP Remote File Inclusion (CWE-98)

2025-03-03 audit@patchstack.com

Information Disclosure LFI PHP

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 01:27 vuln.today

v3 (cvss_changed)

Analysis Updated

Apr 25, 2026 - 01:27 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 03, 2025 - 14:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NotFound WP Vehicle Manager allows PHP Local File Inclusion. This issue affects WP Vehicle Manager: from n/a through 3.1.

AnalysisAI

Local file inclusion in WP Vehicle Manager 3.1 and earlier allows remote unauthenticated attackers to read arbitrary files on the server or potentially execute code via PHP file inclusion. Classified as CWE-98 (PHP Remote File Inclusion) but exploits local file paths. EPSS score of 0.30% (53rd percentile) indicates below-average exploitation probability, with no CISA KEV listing or confirmed active exploitation. Patchstack vulnerability database confirms the issue affects arbitrary shortcode execution paths, suggesting exploitation requires specific WordPress shortcode processing contexts.

Technical ContextAI

This vulnerability stems from improper validation in PHP include/require statements within the WP Vehicle Manager WordPress plugin. CWE-98 covers PHP file inclusion vulnerabilities where attacker-controlled input influences file paths passed to include(), require(), include_once(), or require_once() functions. Despite the CWE title mentioning 'Remote File Inclusion', the tags indicate Local File Inclusion (LFI), meaning attackers likely manipulate file paths to include existing files on the server rather than external URLs. The CVSS vector AV:N confirms network-based attack delivery, while AC:H (high complexity) suggests exploitation requires specific conditions beyond simple parameter manipulation. WordPress plugins commonly expose this vulnerability class through improperly sanitized shortcode attributes, AJAX handlers, or template loading mechanisms that accept user-supplied file paths without adequate allowlist validation or path traversal protections.

Affected ProductsAI

WordPress WP Vehicle Manager plugin versions 3.1 and earlier are confirmed vulnerable per Patchstack database advisories. The vulnerability report indicates the affected version range extends from an unspecified earliest version through 3.1, suggesting the flaw exists in the core plugin architecture rather than a recent regression. No CPE strings were provided in the source data, preventing precise enumeration of affected platform combinations. Organizations should verify their installed version via WordPress admin dashboard under Plugins > Installed Plugins and cross-reference with Patchstack advisories at https://patchstack.com/database/wordpress/plugin/js-vehicle-manager/vulnerability/wordpress-embed-rss-plugin-3-1-arbitrary-shortcode-execution-vulnerability-3.

RemediationAI

Upgrade WP Vehicle Manager to the latest version available from the WordPress plugin repository, as versions after 3.1 are expected to contain fixes for this file inclusion vulnerability. Visit the official WordPress plugin page or Patchstack advisory at https://patchstack.com/database/wordpress/plugin/js-vehicle-manager/vulnerability/wordpress-embed-rss-plugin-3-1-arbitrary-shortcode-execution-vulnerability-3 to confirm the patched version number. If immediate upgrade is not feasible, implement compensating controls: disable the WP Vehicle Manager plugin entirely until patching is complete; restrict shortcode execution to trusted administrator accounts only by removing do_shortcode() filters from untrusted content areas; apply web application firewall rules to block requests containing path traversal sequences (../, ..\, %2e%2e%2f) in parameters passed to plugin endpoints; enable PHP open_basedir restrictions to confine file access to WordPress directories only, though this may impact legitimate plugin functionality and requires testing. Monitor WordPress and PHP error logs for failed file inclusion attempts as an early warning indicator.