Cyber Resilience

CVE-2025-12497

High

Published: 05 November 2025

Published
05 November 2025
Modified
15 April 2026
KEV Added
Patch
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0029 52.6th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-12497 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 47.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-12497 is a Local File Inclusion (LFI) vulnerability affecting the Premium Portfolio Features for Phlox theme plugin for WordPress, in all versions up to and including 2.3.10. The flaw exists via the 'args[extra_template_path]' parameter, which allows unauthenticated attackers to include and execute arbitrary .php files on the server. This enables the execution of PHP code within those files. The vulnerability is rated with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H) and is associated with CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).

Unauthenticated attackers can exploit this vulnerability remotely over the network, though it requires high attack complexity. Successful exploitation allows attackers to execute arbitrary PHP code by including malicious or existing .php files, potentially bypassing access controls, obtaining sensitive data, or achieving remote code execution, particularly in scenarios where .php file uploads are possible on the server.

Mitigation details are available in the referenced advisories: a patch has been committed in the WordPress plugin trac changeset at https://plugins.trac.wordpress.org/changeset/3388727/auxin-portfolio, and further threat intelligence is provided by Wordfence at https://www.wordfence.com/threat-intel/vulnerabilities/id/518abad2-d3cc-4d15-83d2-8fd99d30500c?source=cve. Security practitioners should update to a patched version of the plugin beyond 2.3.10.

EU & UK References

Vulnerability details

The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the 'args[extra_template_path]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary…

more

.php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The LFI vulnerability in the WordPress plugin allows unauthenticated remote attackers to include and execute arbitrary PHP files, directly enabling exploitation of a public-facing application.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-28087Shared CWE-98
CVE-2025-23952Shared CWE-98
CVE-2026-32505Shared CWE-98
CVE-2025-48149Shared CWE-98
CVE-2025-60058Shared CWE-98
CVE-2025-49994Shared CWE-98
CVE-2026-24531Shared CWE-98
CVE-2025-67527Shared CWE-98
CVE-2025-69396Shared CWE-98
CVE-2025-62067Shared CWE-98

Affected Assets

Wordpress
inferred from references and description; NVD did not file a CPE for this CVE

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly mitigates the LFI vulnerability by requiring identification, reporting, and timely patching of the affected Phlox theme plugin versions up to 2.3.10.

prevent

Prevents exploitation by validating the 'args[extra_template_path]' parameter to ensure only authorized file paths are included, blocking arbitrary PHP file execution.

prevent

Enforces secure configuration settings for the WordPress plugin to restrict template path parameters and minimize exposure to LFI attacks.

References