What is the CVSS score of CVE-2025-49275?

CVE-2025-49275 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-49275?

A high-severity PHP file inclusion vulnerability in Unfoldwp Blogbyte (versions through 1.1.1) allows attackers to read sensitive files from affected servers.

How to fix or mitigate CVE-2025-49275?

Within 24 hours: Identify all instances of Blogbyte plugin across your WordPress infrastructure and assess active usage. Within 7 days: Implement WAF rules to block suspicious file inclusion patterns and disable the Blogbyte plugin if not critical to operations. Within 30 days: Evaluate alternative plugins, plan migration strategy, and monitor vendor communications for patch availability; consider upgrading to a patched version immediately upon release.

PHP CVE-2025-49275

EUVD-2025-17541 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-09 audit@patchstack.com

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17541

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unfoldwp Blogbyte allows PHP Local File Inclusion. This issue affects Blogbyte: from n/a through 1.1.1.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in Unfoldwp Blogbyte versions through 1.1.1, stemming from improper control of filenames in PHP include/require statements. An unauthenticated remote attacker can exploit this vulnerability with high complexity to achieve arbitrary code execution, information disclosure, or service disruption. While the CVSS score of 8.1 reflects severe potential impact, the High attack complexity (AC:H) suggests exploitation requires specific conditions or timing, and KEV/active exploitation status and POC availability remain unconfirmed from available intelligence.

Technical ContextAI

The vulnerability is rooted in CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP security flaw where user-controlled input is directly passed to PHP's include(), require(), include_once(), or require_once() functions without proper sanitization or validation. Blogbyte, an Unfoldwp WordPress plugin/theme component, likely accepts unsanitized parameters (via GET, POST, or other input vectors) that are subsequently used in file inclusion statements. This differs from Remote File Inclusion (RFI) in that it typically exploits Local File Inclusion (LFI) to read sensitive files (wp-config.php, /etc/passwd) or leverage log poisoning/file upload chains to achieve RCE. The advisory description notes 'PHP Local File Inclusion' despite the title mentioning RFI, indicating LFI as the primary vector, though misconfigured allow_url_include settings could enable RFI variants.

RemediationAI

Immediate actions: (1) Update Blogbyte to the first patched version following 1.1.1 (specific version number requires vendor advisory confirmation); (2) If patch unavailable, disable Blogbyte or remove it entirely; (3) Apply input validation: whitelist acceptable filenames, use basename() to strip directory traversal attempts, and implement strict parameter validation before any include/require operation; (4) Use PHP configuration hardening: disable allow_url_include, restrict open_basedir, and use suhosin or similar PHP security extensions; (5) Implement Web Application Firewall (WAF) rules to block LFI patterns (../, etc/passwd, etc); (6) Monitor logs for suspicious include attempts. Vendor patch version and advisory link should be obtained from Unfoldwp official channels or WordPress Security Team.