PHP CVE-2025-48126

The CVSS:3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network-accessible exploitation with HIGH attack complexity and no privileges required. The HIGH complexity factor may reflect: (1) requirement for specific server configurations (e.g., particular PHP wrappers enabled, file paths known to attacker), (2) exploitation conditions (certain local files must exist and be readable), or (3) payload encoding/obfuscation required. The 8.1 score reflects high confidentiality (information disclosure), integrity (code execution/file modification), and availability impacts. Without access to EPSS scoring or KEV/CISA alert status from provided data, assessment must rely on: (a) LFI vulnerabilities are highly exploitable when common includable files exist (e.g., /etc/passwd, session files, access logs), (b) WordPress plugins are frequently targeted, (c) the AC:H rating suggests this is NOT a trivial one-click exploit, but rather requires reconnaissance or specific conditions. Real-world priority: MEDIUM-HIGH. This is a legitimate RCE vector if log poisoning or session file inclusion is possible, but AC:H prevents it from being a critical mass-exploitation risk.

Attack Flow: (1) Attacker identifies a vulnerable parameter in g5theme Essential Real Estate (likely a query parameter, POST variable, or request header controlling a file path, e.g., ?page=../../wp-config.php or ?template=../../../etc/passwd). (2) Attacker performs reconnaissance to enumerate local files accessible from web root (common targets: /etc/passwd, /var/log/apache2/access.log, wp-config.php, .htaccess, session files in /tmp). (3) Attacker crafts LFI payload, e.g., vulnerable_param=../../../../var/log/apache2/access.log, causing the plugin to execute: include($_GET['param']). (4) If log poisoning is feasible, attacker injects PHP code via User-Agent header or request path, then includes the log file to achieve RCE. Alternatively, if session files are readable, attacker may include serialized session data containing PHP code. (5) Attack Complexity (AC:H) factor: Attacker must: (a) identify the vulnerable parameter through fuzzing/code review, (b) know or guess valid local file paths, (c) ensure PHP execution context allows file inclusion. Proof-of-Concept status: None explicitly noted in provided data, but LFI exploits are well-understood; researcher should search Exploit-DB, GitHub, and security blogs for public POCs leveraging g5theme Essential Real Estate specifically. If POC exists, exploitation risk escalates significantly.