CVE-2025-62753
Lifecycle Timeline
2Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MadrasThemes MAS Videos masvideos allows PHP Local File Inclusion.This issue affects MAS Videos: from n/a through <= 1.3.4.
Analysis
Local file inclusion vulnerability in MadrasThemes MAS Videos WordPress plugin versions up to 1.3.4 allows unauthenticated attackers to read arbitrary files from the affected server through improper control of filename parameters in PHP include/require statements. The vulnerability affects the masvideos plugin and has been tracked by Patchstack with an EPSS score of 0.17% (38th percentile), indicating low exploitation probability despite the presence of information disclosure risk.
Technical Context
This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP Local File Inclusion (LFI) flaw. The MAS Videos plugin fails to properly sanitize or validate user-supplied input before passing it to PHP include() or require() functions. Attackers can manipulate filename parameters to traverse directory paths (e.g., using ../ sequences or absolute paths) and include arbitrary files from the server filesystem, potentially reading sensitive configuration files, source code, or system files. The plugin architecture in WordPress context means this affects any site running the vulnerable masvideos plugin through version 1.3.4.
Affected Products
MadrasThemes MAS Videos WordPress plugin versions from an unspecified baseline through 1.3.4 inclusive are affected. The plugin is identified by CPE reference to masvideos and is distributed via the WordPress plugin ecosystem. Detailed version ranges and exact CPE designation should be confirmed via the Patchstack vulnerability database and WordPress.org plugin repository.
Remediation
Update the MAS Videos plugin immediately to the patched version released after 1.3.4. Patchstack has published a vulnerability advisory at https://patchstack.com/database/Wordpress/Plugin/masvideos/vulnerability/wordpress-mas-videos-plugin-1-3-2-local-file-inclusion-vulnerability?_s_id=cve which includes the fixed version number and detailed remediation guidance. If an immediate update is not possible, disable the plugin and review access logs for evidence of exploitation targeting file inclusion parameters. Web application firewall rules should be deployed to block requests containing directory traversal sequences (../, absolute paths) in parameters known to be vulnerable.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today