CVE-2025-1707
Published: 11 March 2025
Summary
CVE-2025-1707 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 46.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-1707 is a Local File Inclusion (LFI) vulnerability (CWE-98) affecting the Review Schema plugin for WordPress in all versions up to and including 2.2.4. The flaw occurs via post meta handling, enabling the inclusion and execution of arbitrary files on the server. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to its potential for confidentiality, integrity, and availability impacts.
Authenticated attackers with contributor-level permissions or higher can exploit this vulnerability remotely over the network with low complexity. By manipulating post meta, they can include arbitrary files, execute PHP code within those files, bypass access controls, obtain sensitive data, or achieve remote code execution if PHP files are uploadable and includable.
Wordfence advisories provide detailed threat intelligence on the vulnerability, while the plugin's Trac repository shows the vulnerable code at line 108 in ReviewSchema.php (version 2.2.4) and a patch applied in changeset 3253799. Security practitioners should update the plugin beyond version 2.2.4 to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-7411
Vulnerability details
The Review Schema plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.4 via post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary…
more
files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in public-facing WordPress plugin enables remote file inclusion and PHP code execution by authenticated users, directly mapping to exploitation of public-facing applications (T1190) and command/scripting interpreter usage for RCE (T1059).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the LFI vulnerability by requiring timely identification, reporting, and patching of the flaw in the Review Schema plugin beyond version 2.2.4.
Requires validation of post meta inputs to block malicious file paths that enable arbitrary file inclusion and PHP code execution.
Enforces approved authorizations to prevent authenticated contributor-level users from accessing and executing arbitrary files via post meta.