North Required Plugin CVE-2025-63003

Exploitation requires the attacker to control the filename used in a PHP include/require statement within North - Required Plugin version 1.4.2 or earlier; this is the concrete condition (CWE-98 PHP file inclusion). The CVSS vector requires authenticated access at a low privilege level (PR:L), so an attacker must hold a valid, low-privilege account on the target WordPress site rather than being fully anonymous. High attack complexity (AC:H) implies additional conditions or non-trivial steps must be met for reliable inclusion; no user interaction is required (UI:N). The main limiting factors are the authentication requirement, the elevated attack complexity, and the plugin's narrow deployment footprint; full remote code execution additionally depends on whether attacker-controlled PHP content can be reached by the include path.

This is a CWE-98 PHP file-inclusion flaw in the WordPress plugin 'North - Required Plugin' (fuelthemes), scored CVSS 7.5. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates network-reachable but authenticated (PR:L) exploitation with high attack complexity (AC:H), yielding full confidentiality, integrity, and availability impact. The high C/I/A triad reflects that a successful PHP Local/Remote File Inclusion can escalate to code execution. Real-world risk signals are modest and consistent: EPSS is low at 0.46% (38th percentile), there is no CISA KEV listing, and no public exploit code was referenced - so this is no public exploit identified at time of analysis. The combination of required authentication (PR:L), high attack complexity (AC:H), and a niche theme-companion plugin tempers the headline 7.5 score; this is a legitimate patch-worthy issue but not an emergency priority absent evidence of active exploitation. One caveat: the vendor-reported AC:H and the C:H/I:H/A:H triad are not fully justified by the one-line description, so the precise exploitation complexity should be verified against the Patchstack advisory.

An attacker with low-privilege authenticated access to a WordPress site running North - Required Plugin (<= 1.4.2) submits a request that controls a filename passed to a PHP include/require statement, causing the plugin to include an attacker-influenced file. Depending on configuration this discloses sensitive local files or, if attacker-controlled PHP content can be reached, leads to code execution. No public proof-of-concept was identified at the time of analysis.