EUVD-2025-17541CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unfoldwp Blogbyte allows PHP Local File Inclusion. This issue affects Blogbyte: from n/a through 1.1.1.
AnalysisAI
PHP Local File Inclusion (LFI) vulnerability in Unfoldwp Blogbyte versions through 1.1.1, stemming from improper control of filenames in PHP include/require statements. An unauthenticated remote attacker can exploit this vulnerability with high complexity to achieve arbitrary code execution, information disclosure, or service disruption. While the CVSS score of 8.1 reflects severe potential impact, the High attack complexity (AC:H) suggests exploitation requires specific conditions or timing, and KEV/active exploitation status and POC availability remain unconfirmed from available intelligence.
Technical ContextAI
The vulnerability is rooted in CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP security flaw where user-controlled input is directly passed to PHP's include(), require(), include_once(), or require_once() functions without proper sanitization or validation. Blogbyte, an Unfoldwp WordPress plugin/theme component, likely accepts unsanitized parameters (via GET, POST, or other input vectors) that are subsequently used in file inclusion statements. This differs from Remote File Inclusion (RFI) in that it typically exploits Local File Inclusion (LFI) to read sensitive files (wp-config.php, /etc/passwd) or leverage log poisoning/file upload chains to achieve RCE. The advisory description notes 'PHP Local File Inclusion' despite the title mentioning RFI, indicating LFI as the primary vector, though misconfigured allow_url_include settings could enable RFI variants.
RemediationAI
Immediate actions: (1) Update Blogbyte to the first patched version following 1.1.1 (specific version number requires vendor advisory confirmation); (2) If patch unavailable, disable Blogbyte or remove it entirely; (3) Apply input validation: whitelist acceptable filenames, use basename() to strip directory traversal attempts, and implement strict parameter validation before any include/require operation; (4) Use PHP configuration hardening: disable allow_url_include, restrict open_basedir, and use suhosin or similar PHP security extensions; (5) Implement Web Application Firewall (WAF) rules to block LFI patterns (../, etc/passwd, etc); (6) Monitor logs for suspicious include attempts. Vendor patch version and advisory link should be obtained from Unfoldwp official channels or WordPress Security Team.
Share
External POC / Exploit Code
Leaving vuln.today