What is the CVSS score of CVE-2025-48126?

CVE-2025-48126 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-48126?

A critical file inclusion vulnerability in the g5theme Essential Real Estate plugin (versions up to 5.2.1) could allow attackers to access sensitive files or execute arbitrary code on affected…

How to fix or mitigate CVE-2025-48126?

Within 24 hours: Identify all WordPress installations using g5theme Essential Real Estate and document versions in use. Within 7 days: Implement Web Application Firewall (WAF) rules to block malicious file inclusion attempts and disable the affected plugin functionality if possible. Within 30 days: Monitor vendor channels for patch availability and prepare a deployment plan; consider alternative plugins if no patch timeline is provided by the vendor.

PHP CVE-2025-48126

EUVD-2025-17528 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-09 audit@patchstack.com

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:42 NVD

CRITICAL HIGH

CVSS changed

Apr 23, 2026 - 15:42 NVD

9.8 (CRITICAL) 8.1 (HIGH)

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17528

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate allows PHP Local File Inclusion. This issue affects Essential Real Estate: from n/a through 5.2.1.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in g5theme Essential Real Estate plugin versions through 5.2.1, allowing unauthenticated remote attackers to include and execute arbitrary local files on the affected server. The vulnerability stems from improper control of filename parameters in PHP include/require statements (CWE-98), enabling potential information disclosure, code execution, and system compromise. While the CVSS score of 8.1 indicates high severity with high confidentiality and integrity impact, real-world exploitation depends on server configuration, file system permissions, and available local files for inclusion.

Technical ContextAI

This vulnerability exploits improper input validation in PHP file inclusion functions (include(), require(), include_once(), require_once()). The g5theme Essential Real Estate plugin (WordPress theme/plugin component) fails to sanitize user-supplied input before passing it to file inclusion statements, allowing attackers to manipulate the filename parameter to include arbitrary local files from the web server's filesystem. CWE-98 specifically addresses failure to validate/sanitize the path used in include/require statements. This is distinguishable from Remote File Inclusion (RFI) as it targets local files only, but can be equally dangerous depending on the availability of includable files (e.g., log files containing PHP code, uploaded files, configuration files, or source code). The vulnerability affects Essential Real Estate versions from inception through 5.2.1, indicating it has been present across the product's supported lifecycle.

RemediationAI

Immediate Actions: (1) Upgrade g5theme Essential Real Estate to version 5.2.2 or later (assumed patch version; verify with vendor release notes). (2) If immediate patching unavailable: disable the g5theme Essential Real Estate plugin via WordPress admin or deactivate in wp-config.php until patch is applied. (3) Review web server logs and WordPress activity logs for evidence of exploitation (unusual include/require calls, file access patterns). Secondary Measures: (1) Implement Web Application Firewall (WAF) rules to block common LFI payloads (e.g., ../../../, file://, php://, expect://, zip://, glob:// wrappers). (2) Restrict PHP's allow_url_include and allow_url_fopen directives to 'Off' in php.ini if not required for legitimate functionality. (3) Implement principle of least privilege: ensure web server user (www-data, apache) has minimal filesystem permissions. (4) Monitor for configuration drift. Reference vendor advisory from g5theme for official patch distribution and release date. Check WordPress.org plugin security notices and WPScan WordPress Vulnerability Database for confirmation.