PHP CVE-2026-25017

NaturaLife Extensions plugin version 2.1 and earlier with local file inclusion via unvalidated filename parameter in include/require statement. Requires attacker to craft malicious request with path traversal payload. No authentication required; remote unauthenticated exploitation possible if vulnerable include/require statement is exposed.

Without a CVSS vector, EPSS score, or KEV designation, risk assessment relies on the vulnerability class and attack surface. CWE-98 vulnerabilities are typically high-impact because they enable information disclosure with low complexity and no authentication required. LFI against a WordPress plugin represents a moderate attack surface (WordPress sites are ubiquitous, but this is a third-party plugin). The lack of published CVSS/EPSS data suggests either recent discovery or low vendor response priority. The attack is likely automatable, as LFI exploitation typically involves predictable file paths (e.g., /etc/passwd, wp-config.php). This should be treated as a real priority for affected organizations, particularly those hosting sensitive data, as successful exploitation directly leads to credential compromise and further system compromise. The absence of patch availability increases urgency.

An attacker discovers the NaturaLife Extensions plugin is active on a WordPress site and crafts a malicious request containing a path traversal payload (e.g., a URL parameter like ?file=../../../../etc/passwd or ?file=../../../wp-config.php) that is passed directly to a PHP include() statement without validation. The server executes the request and returns the contents of the targeted local file, including database credentials embedded in wp-config.php. The attacker uses these credentials to access the WordPress database directly, escalate privileges, or pivot to other systems. This attack requires no authentication and can be automated with simple scripts to enumerate common file locations and exfiltrate sensitive data at scale.