EUVD-2025-17261CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magazine3 WP Multilang allows PHP Local File Inclusion. This issue affects WP Multilang: from n/a through 2.4.19.
Analysis
PHP Local File Inclusion (LFI) vulnerability in Magazine3's WP Multilang plugin versions up to 2.4.19, stemming from improper control of filenames in PHP include/require statements. An authenticated attacker with low privileges can exploit this vulnerability to read arbitrary local files on the affected WordPress server, potentially leading to information disclosure, code execution, or system compromise. The CVSS score of 7.5 reflects high confidentiality and integrity impact, though exploitation requires valid credentials and non-standard conditions (AC:H).
Technical Context
This vulnerability exploits PHP's dynamic file inclusion mechanisms (include/require statements) where user-controlled input is insufficiently validated before being passed as a file path parameter. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) is the root cause classification—a critical weakness in languages with dynamic file inclusion capabilities. The WP Multilang plugin, used for managing multi-language content in WordPress installations, likely fails to sanitize or whitelist file paths in one or more functions responsible for loading language files or configuration files. An attacker with WordPress user credentials can manipulate parameters (such as language selection, configuration keys, or module names) to traverse the filesystem and include arbitrary PHP or text files, potentially reaching sensitive files like wp-config.php (containing database credentials), .htaccess, /etc/passwd (if readable via PHP), or other plugins' configuration files. The vulnerability is classified as LFI rather than RFI because the attack vector requires local file access, not remote URL inclusion.
Affected Products
Magazine3 WP Multilang plugin, versions 2.4.19 and earlier (affected range: n/a through 2.4.19, suggesting all versions up to and including 2.4.19 are vulnerable). CPE identifier likely: cpe:2.3:a:magazine3:wp_multilang:*:*:*:*:*:wordpress:*:* (version ≤2.4.19). Affected systems: WordPress installations with WP Multilang plugin active. The vulnerability requires authenticated access (PR:L), so it affects WordPress instances with user registration enabled or with accounts created for contributors, editors, or administrators. Patch/remediation version information: The vulnerability description states it affects through version 2.4.19, implying patches may exist in version 2.4.20 or later—vendors should consult Magazine3's official security advisory or plugin repository release notes for confirmed patch availability.
Remediation
Immediate actions: (1) Update WP Multilang plugin to the latest version released after 2.4.19 (version 2.4.20 or later if available from the official WordPress plugin repository or Magazine3); (2) If no patch is available, disable or remove the WP Multilang plugin until a patch is released; (3) Implement Web Application Firewall (WAF) rules to detect LFI payloads in plugin parameters (e.g., filter for ../, null bytes, or suspicious file paths). Mitigations for unpatched systems: (a) Restrict WordPress user permissions—limit 'contributor' and 'editor' roles to trusted users only; (b) Implement IP whitelisting for WordPress admin and user login pages; (c) Monitor file access logs for unusual include/require patterns targeting sensitive files like wp-config.php. Vendor advisory: Consult Magazine3's official security page or the WordPress plugin repository (wordpress.org/plugins/wp-multilang) for patch release notes and security advisories. Consider subscribing to Magazine3 security notifications or the WordPress plugin security mailing list for timely updates.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today