EUVD-2025-17544CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionNVD
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unfoldwp Blogty allows PHP Local File Inclusion. This issue affects Blogty: from n/a through 1.0.11.
AnalysisAI
PHP Local File Inclusion (LFI) vulnerability in Unfoldwp Blogty plugin versions up to 1.0.11 that allows unauthenticated remote attackers to include and execute arbitrary local files through improper control of filename parameters in PHP include/require statements. The vulnerability has a CVSS score of 8.1 (High), indicating potential for confidentiality, integrity, and availability compromise. Active exploitation status and EPSS probability are critical factors in determining real-world risk severity.
Technical ContextAI
This vulnerability exploits improper input validation in PHP file inclusion mechanisms (include/require functions), classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Unfoldwp Blogty WordPress plugin fails to adequately sanitize or validate user-supplied input before passing it to PHP's include() or require() functions. Unlike Remote File Inclusion (RFI), this LFI variant allows inclusion of files already present on the server filesystem, potentially including configuration files containing credentials, application source code, or session data. The attack vector is Network with High complexity (AC:H), suggesting the exploitation requires specific conditions such as knowledge of file paths or special request formatting, but no authentication (PR:N) or user interaction (UI:N) is required.
RemediationAI
- Immediate: Update Unfoldwp Blogty plugin to version 1.0.12 or later (patch version should be confirmed in official Unfoldwp/WordPress Plugin Directory repository). 2) Verification: Check WordPress admin dashboard under Plugins for Blogty and confirm current version; apply updates via Plugins > Updates if available. 3) Workaround (temporary): Disable the Blogty plugin if update is unavailable and alternative themes are deployable; this eliminates attack surface until patched. 4) Detection: Review web server access logs (Apache/Nginx) for suspicious include/require parameter manipulation or path traversal patterns (e.g., '../', '..\', 'php://filter/', 'phar://' in query strings or POST data) targeting Blogty-related endpoints. 5) Long-term: Implement Web Application Firewall (WAF) rules to block common LFI payloads and monitor file inclusion patterns.
Share
External POC / Exploit Code
Leaving vuln.today