EUVD-2025-17543CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unfoldwp Blogprise allows PHP Local File Inclusion. This issue affects Blogprise: from n/a through 1.0.9.
AnalysisAI
PHP Local File Inclusion (LFI) vulnerability in Unfoldwp Blogprise WordPress plugin versions through 1.0.9, stemming from improper control of filename parameters in PHP include/require statements (CWE-98). An unauthenticated remote attacker can exploit this vulnerability over the network to read arbitrary files from the server filesystem, potentially leading to information disclosure, code execution, or further compromise. The CVSS 8.1 score reflects high severity with network accessibility and significant confidentiality/integrity/availability impact, though attack complexity is rated as high suggesting specific conditions must be met for exploitation.
Technical ContextAI
This vulnerability exploits improper input validation in PHP file inclusion operations. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) describes the root cause where user-controlled input is passed unsanitized to PHP functions like include(), require(), include_once(), or require_once(). While the CVE description mentions 'Remote File Inclusion,' the vulnerability is characterized as Local File Inclusion (LFI), allowing attackers to include local files from the server (e.g., /etc/passwd, wp-config.php, application logs) rather than remote files. The affected product is Unfoldwp Blogprise, a WordPress plugin (implied by WordPress-specific context), specifically versions from an unspecified starting point through 1.0.9. The AC:H (Attack Complexity: High) component suggests exploitation requires specific conditions such as particular PHP configurations (e.g., allow_url_include disabled) or specific request parameters that may be difficult to discover or require knowledge of the application's internal structure.
RemediationAI
Immediate Actions: (1) Update Unfoldwp Blogprise to the latest version available from the official WordPress plugin repository or Unfoldwp's official channels (version > 1.0.9 should contain a fix). (2) If an immediate patch is unavailable, disable or deactivate the Blogprise plugin until a patched version is released. Mitigation Strategies: (1) Implement Web Application Firewall (WAF) rules to detect and block common LFI payloads (e.g., patterns containing '../', 'file://', or null byte injection attempts). (2) Apply the principle of least privilege to web server processes; restrict PHP's open_basedir directive to limit the filesystem scope accessible to the application. (3) Harden PHP configuration by ensuring allow_url_include=Off to prevent remote file inclusion if applicable. (4) Monitor file access logs for suspicious include/require operations and unexpected file reads from sensitive locations (e.g., /etc/passwd, wp-config.php). (5) Implement input validation and sanitization in any custom code interfacing with Blogprise. Long-term: Review the plugin's source code (if available) to ensure all file inclusion operations use strict whitelist-based validation rather than user-supplied filenames.
Share
External POC / Exploit Code
Leaving vuln.today