What is the CVSS score of CVE-2025-47586?

CVE-2025-47586 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-47586?

A critical PHP file inclusion vulnerability in the StylemixThemes Motors - Events plugin (versions through 1.4.7) allows attackers to execute arbitrary code on affected WordPress installations.

How to fix or mitigate CVE-2025-47586?

Within 24 hours: Identify all WordPress instances using Motors - Events plugin and isolate or disable the plugin immediately. Within 7 days: Implement Web Application Firewall (WAF) rules blocking suspicious file inclusion patterns and monitor access logs for exploitation attempts. Within 30 days: Plan migration to alternative event management solutions and establish a vendor communication protocol for security updates.

PHP CVE-2025-47586

EUVD-2025-17129 CRITICAL

PHP Remote File Inclusion (CWE-98)

2025-06-06 audit@patchstack.com

PHP WordPress Information Disclosure LFI Wordpress Plugin

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17129

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 12:15 nvd

CRITICAL 9.0

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in StylemixThemes Motors - Events allows PHP Local File Inclusion.This issue affects Motors - Events: from n/a through 1.4.7.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in StylemixThemes Motors - Events plugin affecting versions up to 1.4.7, allowing unauthenticated remote attackers to include and execute arbitrary PHP files under certain conditions. With a CVSS score of 9.0 and network accessibility, this vulnerability enables complete system compromise through code execution. Active exploitation status and proof-of-concept availability should be verified through KEV database and security research databases.

Technical ContextAI

The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a critical flaw in PHP file inclusion mechanisms. The Motors - Events plugin, a WordPress theme/plugin component by StylemixThemes, fails to properly sanitize or validate user-supplied input before passing it to PHP's include() or require() statements. This allows attackers to manipulate file paths to include files from the local filesystem (LFI) or potentially remote sources (RFI). The affected component processes untrusted input (likely via GET/POST parameters or file paths) without adequate validation, enabling traversal attacks (e.g., '../../../etc/passwd') or inclusion of uploaded files containing malicious PHP code. The vulnerability affects StylemixThemes Motors - Events from unspecified early versions through version 1.4.7.