What is the CVSS score of CVE-2025-49307?

CVE-2025-49307 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2025-49307?

A critical vulnerability in WP Multilang (affecting versions through 2.4.19) allows attackers to include and execute arbitrary local files on affected WordPress installations, potentially exposing…

How to fix or mitigate CVE-2025-49307?

Within 24 hours: Audit all WordPress installations for WP Multilang plugin version and disable the plugin immediately if present. Within 7 days: Implement Web Application Firewall rules to block suspicious file inclusion patterns and review access logs for exploitation attempts. Within 30 days: Evaluate alternative multilingual plugins or contact Magazine3 for patch availability; if no patch emerges, plan plugin replacement or implement network segmentation to restrict plugin functionality.

PHP CVE-2025-49307

EUVD-2025-17261 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-06 audit@patchstack.com

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2025-17261

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Magazine3 WP Multilang allows PHP Local File Inclusion. This issue affects WP Multilang: from n/a through 2.4.19.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in Magazine3's WP Multilang plugin versions up to 2.4.19, stemming from improper control of filenames in PHP include/require statements. An authenticated attacker with low privileges can exploit this vulnerability to read arbitrary local files on the affected WordPress server, potentially leading to information disclosure, code execution, or system compromise. The CVSS score of 7.5 reflects high confidentiality and integrity impact, though exploitation requires valid credentials and non-standard conditions (AC:H).

Technical ContextAI

This vulnerability exploits PHP's dynamic file inclusion mechanisms (include/require statements) where user-controlled input is insufficiently validated before being passed as a file path parameter. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) is the root cause classification—a critical weakness in languages with dynamic file inclusion capabilities. The WP Multilang plugin, used for managing multi-language content in WordPress installations, likely fails to sanitize or whitelist file paths in one or more functions responsible for loading language files or configuration files. An attacker with WordPress user credentials can manipulate parameters (such as language selection, configuration keys, or module names) to traverse the filesystem and include arbitrary PHP or text files, potentially reaching sensitive files like wp-config.php (containing database credentials), .htaccess, /etc/passwd (if readable via PHP), or other plugins' configuration files. The vulnerability is classified as LFI rather than RFI because the attack vector requires local file access, not remote URL inclusion.

RemediationAI

Immediate actions: (1) Update WP Multilang plugin to the latest version released after 2.4.19 (version 2.4.20 or later if available from the official WordPress plugin repository or Magazine3); (2) If no patch is available, disable or remove the WP Multilang plugin until a patch is released; (3) Implement Web Application Firewall (WAF) rules to detect LFI payloads in plugin parameters (e.g., filter for ../, null bytes, or suspicious file paths). Mitigations for unpatched systems: (a) Restrict WordPress user permissions—limit 'contributor' and 'editor' roles to trusted users only; (b) Implement IP whitelisting for WordPress admin and user login pages; (c) Monitor file access logs for unusual include/require patterns targeting sensitive files like wp-config.php. Vendor advisory: Consult Magazine3's official security page or the WordPress plugin repository (wordpress.org/plugins/wp-multilang) for patch release notes and security advisories. Consider subscribing to Magazine3 security notifications or the WordPress plugin security mailing list for timely updates.