What is the CVSS score of CVE-2025-49276?

CVE-2025-49276 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-49276?

A critical vulnerability in Blogmine plugin versions up to 1.1.7 allows attackers to access sensitive files on affected servers through local file inclusion attacks.

How to fix or mitigate CVE-2025-49276?

Within 24 hours: Inventory all systems running Blogmine and assess exposure; disable the plugin if non-critical or isolate affected environments. Within 7 days: Implement WAF rules to block suspicious file inclusion patterns in requests; restrict plugin functionality through network segmentation. Within 30 days: Monitor vendor for patch release; evaluate alternative plugins; conduct security audit of affected systems for unauthorized file access.

PHP CVE-2025-49276

EUVD-2025-17542 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-09 audit@patchstack.com

PHP LFI Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17542

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unfoldwp Blogmine allows PHP Local File Inclusion. This issue affects Blogmine: from n/a through 1.1.7.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in Unfoldwp Blogmine versions up to 1.1.7 that allows unauthenticated remote attackers to include and execute arbitrary files on the server. The vulnerability stems from improper input validation on filename parameters used in PHP include/require statements (CWE-98). While the CVSS score of 8.1 reflects high impact potential across confidentiality, integrity, and availability, the AC:H (Attack Complexity: High) suggests exploitation requires specific conditions; KEV status, EPSS probability, and public POC availability are critical factors for determining actual prioritization.

Technical ContextAI

This vulnerability exploits a classic PHP file inclusion flaw where user-supplied input is directly passed to include() or require() statements without proper sanitization or validation. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP) is the root cause classification. In Blogmine, likely parameters accepting file paths (such as template, theme, or module identifiers) are processed unsafely. Attackers can leverage this to include local files (LFI) via directory traversal sequences (e.g., '../../etc/passwd') or potentially remote files if PHP wrappers (php://filter, file://) are enabled. The affected product CPE would be vendor:unfoldwp, product:blogmine, version:<=1.1.7. Exploitation does not require authentication (PR:N), indicating the vulnerability is exposed at the application entry point.

RemediationAI

Immediate actions: (1) Update Blogmine to version 1.1.8 or later once available (contact vendor for patch timeline if not yet released). (2) Temporary workarounds: disable Blogmine if not critical; restrict file inclusion functionality via .htaccess (e.g., disable PHP execution in user-controlled directories); implement strict input validation/whitelisting on all file path parameters; review web application firewall (WAF) rules to block directory traversal patterns and PHP wrapper schemes. (3) Long-term: implement secure coding practices—use basename() to strip directory traversal, maintain an allowlist of permitted files, avoid dynamic include paths. (4) Monitor Unfoldwp GitHub/security advisories at https://github.com/unfoldwp/blogmine or vendor website for patch release. (5) Audit access logs for exploitation attempts (patterns like '../../' in request parameters).