EUVD-2025-210359
GHSA-4cx4-gv7f-pqv2
Severity by source
AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable plugin endpoint but requires a Contributor account (PR:L) and non-trivial path conditions (AC:H); LFI can disclose secrets and chain to code execution, supporting C/I/A:H.
Primary rating from Vendor (patchstack).
CVSS VectorVendor: patchstack
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
Contributor Local File Inclusion in Goya Core < 1.0.9.4 versions.
Articles & Coverage 1
AnalysisAI
Local File Inclusion in the Goya Core WordPress plugin (versions before 1.0.9.4) lets authenticated Contributor-level users coerce the application into including arbitrary local files, exposing sensitive server-side content such as configuration files and PHP source. Reported by Patchstack and classified CWE-98, the flaw carries a CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:L), and no public exploit identified at time of analysis. Exploitation requires a valid low-privilege account and the high attack complexity reflects non-trivial preconditions.
Technical ContextAI
Goya Core is an auxiliary/companion plugin for the Goya WordPress theme, written in PHP and running inside the WordPress request lifecycle. The root cause maps to CWE-98 (Improper Control of Filename for Include/Require Statement, the classic PHP RFI/LFI class): a user-controllable parameter flows into a PHP include/require construct without adequate path canonicalization or allow-listing, so directory traversal sequences or crafted paths can redirect the inclusion to unintended local files. Because PHP's include executes any included PHP, an LFI of this class can escalate from information disclosure to code execution when an attacker can plant or reference PHP content (e.g., via log poisoning, uploaded media, or session files). No CPE strings were supplied in the intelligence; the only affected component identifiable from the data is the Goya Core plugin at versions below 1.0.9.4.
RemediationAI
Vendor-released patch: update the Goya Core plugin to version 1.0.9.4 or later, which is the primary and complete fix; verify the running version under wp-admin Plugins after updating. Until the update can be applied, reduce exposure by restricting who holds Contributor or higher roles - audit and remove untrusted Contributor accounts and disable open self-registration (Settings > General > 'Anyone can register'), since the flaw requires an authenticated low-privilege user; the trade-off is that legitimate contributor workflows are paused. As additional compensating controls, deploy a WordPress WAF/virtual patch (Patchstack or equivalent) to block directory-traversal and LFI parameter patterns, and harden PHP by setting open_basedir and disabling allow_url_include/allow_url_fopen to constrain what files can be included, noting this may affect plugins that legitimately fetch remote resources. Reference the advisory: https://patchstack.com/database/wordpress/plugin/goya-core/vulnerability/wordpress-goya-core-plugin-1-0-9-4-local-file-inclusion-vulnerability?_s_id=cve
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
NetAlertX (formerly PiAlert) versions 23.01.14 through 24.x before 24.10.12 allow unauthenticated command injection thro
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
Same weakness CWE-98 – PHP Remote File Inclusion
View allShare
External POC / Exploit Code
Leaving vuln.today