CVE-2025-12497
Published: 05 November 2025
Summary
CVE-2025-12497 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-12497 is a Local File Inclusion (LFI) vulnerability affecting the Premium Portfolio Features for Phlox theme plugin for WordPress, in all versions up to and including 2.3.10. The flaw exists via the 'args[extra_template_path]' parameter, which allows unauthenticated attackers to include and execute arbitrary .php files on the server. This enables the execution of PHP code within those files. The vulnerability is rated with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H) and is associated with CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).
Unauthenticated attackers can exploit this vulnerability remotely over the network, though it requires high attack complexity. Successful exploitation allows attackers to execute arbitrary PHP code by including malicious or existing .php files, potentially bypassing access controls, obtaining sensitive data, or achieving remote code execution, particularly in scenarios where .php file uploads are possible on the server.
Mitigation details are available in the referenced advisories: a patch has been committed in the WordPress plugin trac changeset at https://plugins.trac.wordpress.org/changeset/3388727/auxin-portfolio, and further threat intelligence is provided by Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/518abad2-d3cc-4d15-83d2-8fd99d30500c?source=cve. Security practitioners should update to a patched version of the plugin beyond 2.3.10.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-37776
Vulnerability details
The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the 'args[extra_template_path]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary…
more
.php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The LFI vulnerability in the WordPress plugin allows unauthenticated remote attackers to include and execute arbitrary PHP files, directly enabling exploitation of a public-facing application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the LFI vulnerability by requiring identification, reporting, and timely patching of the affected Phlox theme plugin versions up to 2.3.10.
Prevents exploitation by validating the 'args[extra_template_path]' parameter to ensure only authorized file paths are included, blocking arbitrary PHP file execution.
Enforces secure configuration settings for the WordPress plugin to restrict template path parameters and minimize exposure to LFI attacks.