CVE-2025-11920
Published: 01 November 2025
Summary
CVE-2025-11920 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-11920 is a Local File Inclusion vulnerability (CWE-98) affecting the WPCOM Member plugin for WordPress in all versions up to and including 1.7.14. The flaw exists via the 'action' parameter in one of the plugin's shortcodes, which fails to properly validate inputs, allowing the inclusion and execution of arbitrary .php files on the server. Published on 2025-11-01, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for confidentiality, integrity, and availability impacts.
Authenticated attackers with Contributor-level access or higher can exploit this vulnerability remotely over the network with low complexity and no user interaction required. By manipulating the 'action' parameter, they can include arbitrary .php files, execute PHP code within those files, bypass access controls, obtain sensitive data, or achieve remote code execution, particularly if the environment allows uploading .php files that can then be included.
References include code locations in class-member.php at lines 1119, 1171, and 374 in version 1.7.13, a patch changeset 3385562 in the plugin trunk, and a Wordfence threat intelligence advisory, suggesting mitigation through updating to a patched version beyond 1.7.14.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-37406
Vulnerability details
The WPCOM Member plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7.14 via the action parameter in one of its shortcodes. This makes it possible for authenticated attackers, with Contributor-level access and…
more
above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in WordPress plugin enables remote authenticated attackers to include and execute arbitrary PHP files on a public-facing web application, directly mapping to T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the LFI vulnerability by requiring validation of the untrusted 'action' parameter in the plugin's shortcode to block arbitrary PHP file inclusion.
Mandates timely flaw remediation through updating the WPCOM Member plugin beyond version 1.7.14 where the patch fixes the vulnerable code paths.
Mitigates exploitation by enforcing least privilege, limiting Contributor-level and higher users from accessing the vulnerable shortcode if such permissions are not essential.