What is the CVSS score of CVE-2025-49277?

CVE-2025-49277 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-49277?

A high-severity file inclusion vulnerability in the Blogprise WordPress plugin (versions up to 1.0.9) allows attackers to access sensitive files on affected servers, potentially exposing confidential…

How to fix or mitigate CVE-2025-49277?

Within 24 hours: Inventory all WordPress installations using Blogprise plugin and document affected versions; disable the plugin immediately on production systems as a temporary measure. Within 7 days: Evaluate alternative plugins or custom solutions to replace Blogprise functionality; monitor vendor communication for patch availability. Within 30 days: Once a patch is released, test thoroughly in a staging environment and deploy to all production systems; implement file access monitoring and conduct a security audit of potentially exposed files.

PHP CVE-2025-49277

EUVD-2025-17543 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-09 audit@patchstack.com

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 19:21 euvd

EUVD-2025-17543

Analysis Generated

Mar 14, 2026 - 19:21 vuln.today

CVE Published

Jun 09, 2025 - 16:15 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unfoldwp Blogprise allows PHP Local File Inclusion. This issue affects Blogprise: from n/a through 1.0.9.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in Unfoldwp Blogprise WordPress plugin versions through 1.0.9, stemming from improper control of filename parameters in PHP include/require statements (CWE-98). An unauthenticated remote attacker can exploit this vulnerability over the network to read arbitrary files from the server filesystem, potentially leading to information disclosure, code execution, or further compromise. The CVSS 8.1 score reflects high severity with network accessibility and significant confidentiality/integrity/availability impact, though attack complexity is rated as high suggesting specific conditions must be met for exploitation.

Technical ContextAI

This vulnerability exploits improper input validation in PHP file inclusion operations. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) describes the root cause where user-controlled input is passed unsanitized to PHP functions like include(), require(), include_once(), or require_once(). While the CVE description mentions 'Remote File Inclusion,' the vulnerability is characterized as Local File Inclusion (LFI), allowing attackers to include local files from the server (e.g., /etc/passwd, wp-config.php, application logs) rather than remote files. The affected product is Unfoldwp Blogprise, a WordPress plugin (implied by WordPress-specific context), specifically versions from an unspecified starting point through 1.0.9. The AC:H (Attack Complexity: High) component suggests exploitation requires specific conditions such as particular PHP configurations (e.g., allow_url_include disabled) or specific request parameters that may be difficult to discover or require knowledge of the application's internal structure.

RemediationAI

Immediate Actions: (1) Update Unfoldwp Blogprise to the latest version available from the official WordPress plugin repository or Unfoldwp's official channels (version > 1.0.9 should contain a fix). (2) If an immediate patch is unavailable, disable or deactivate the Blogprise plugin until a patched version is released. Mitigation Strategies: (1) Implement Web Application Firewall (WAF) rules to detect and block common LFI payloads (e.g., patterns containing '../', 'file://', or null byte injection attempts). (2) Apply the principle of least privilege to web server processes; restrict PHP's open_basedir directive to limit the filesystem scope accessible to the application. (3) Harden PHP configuration by ensuring allow_url_include=Off to prevent remote file inclusion if applicable. (4) Monitor file access logs for suspicious include/require operations and unexpected file reads from sensitive locations (e.g., /etc/passwd, wp-config.php). (5) Implement input validation and sanitization in any custom code interfacing with Blogprise. Long-term: Review the plugin's source code (if available) to ensure all file inclusion operations use strict whitelist-based validation rather than user-supplied filenames.