CVE-2025-11746

High

Published: 15 October 2025

Published

15 October 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0018 39.3th percentile

Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-11746 is a high-severity Path Traversal (CWE-22) vulnerability in Wordfence (inferred from references). Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 39.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-11746, published on 2025-10-15, is a Local File Inclusion (LFI) vulnerability (CWE-22) in the XStore theme for WordPress, affecting all versions up to and including 9.5.4. The flaw exists in the et_ajax_required_plugins_popup() function, which enables the inclusion and execution of arbitrary .php files on the server.

Authenticated attackers with Subscriber-level access or higher can exploit this vulnerability over the network with low complexity and no user interaction required. Successful exploitation allows execution of PHP code from included files, potentially bypassing access controls, obtaining sensitive data, or achieving remote code execution if .php file uploads are possible elsewhere in the environment. The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity.

Advisories from Wordfence provide detailed threat intelligence on the issue at https://www.wordfence.com/threat-intel/vulnerabilities/id/2a49db7f-62fc-472d-9edf-de5edbe48219?source=cve, while the XStore theme's update history at https://xstore.8theme.com/update-history/ covers patch information for remediation.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-34502

Vulnerability details

The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php…

files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

CWE(s): CWE-22

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

CVE-2025-11746 is a local file inclusion vulnerability in a public-facing WordPress application, enabling remote code execution for authenticated low-privilege users, directly mapping to T1190: Exploit Public-Facing Application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0