EUVD-2025-17542
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Unfoldwp Blogmine allows PHP Local File Inclusion. This issue affects Blogmine: from n/a through 1.1.7.
Analysis
PHP Local File Inclusion (LFI) vulnerability in Unfoldwp Blogmine versions up to 1.1.7 that allows unauthenticated remote attackers to include and execute arbitrary files on the server. The vulnerability stems from improper input validation on filename parameters used in PHP include/require statements (CWE-98). While the CVSS score of 8.1 reflects high impact potential across confidentiality, integrity, and availability, the AC:H (Attack Complexity: High) suggests exploitation requires specific conditions; KEV status, EPSS probability, and public POC availability are critical factors for determining actual prioritization.
Technical Context
This vulnerability exploits a classic PHP file inclusion flaw where user-supplied input is directly passed to include() or require() statements without proper sanitization or validation. CWE-98 (Improper Control of Filename for Include/Require Statement in PHP) is the root cause classification. In Blogmine, likely parameters accepting file paths (such as template, theme, or module identifiers) are processed unsafely. Attackers can leverage this to include local files (LFI) via directory traversal sequences (e.g., '../../etc/passwd') or potentially remote files if PHP wrappers (php://filter, file://) are enabled. The affected product CPE would be vendor:unfoldwp, product:blogmine, version:<=1.1.7. Exploitation does not require authentication (PR:N), indicating the vulnerability is exposed at the application entry point.
Affected Products
Unfoldwp Blogmine, versions 1.1.7 and earlier (CPE: cpe:2.3:a:unfoldwp:blogmine:*:*:*:*:*:*:*:* with version <= 1.1.7). Specific affected versions include 1.0.0 through 1.1.7. WordPress plugin context suggests typical deployment on WordPress sites. Vendor advisories and patch information should be obtained directly from Unfoldwp security notices, WordPress plugin repository, or GitHub repository if applicable; no specific advisory URL provided in available data.
Remediation
Immediate actions: (1) Update Blogmine to version 1.1.8 or later once available (contact vendor for patch timeline if not yet released). (2) Temporary workarounds: disable Blogmine if not critical; restrict file inclusion functionality via .htaccess (e.g., disable PHP execution in user-controlled directories); implement strict input validation/whitelisting on all file path parameters; review web application firewall (WAF) rules to block directory traversal patterns and PHP wrapper schemes. (3) Long-term: implement secure coding practices—use basename() to strip directory traversal, maintain an allowlist of permitted files, avoid dynamic include paths. (4) Monitor Unfoldwp GitHub/security advisories at https://github.com/unfoldwp/blogmine or vendor website for patch release. (5) Audit access logs for exploitation attempts (patterns like '../../' in request parameters).
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today