CVE-2025-22311
Published: 21 January 2025
Summary
CVE-2025-22311 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 24.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability CVE-2025-22311 is a PHP Remote File Inclusion flaw (CWE-98) arising from improper control of filenames in include/require statements. It affects the Private Messages for UserPro WordPress plugin, impacting all versions through 4.10.0.
An unauthenticated remote attacker can exploit the issue over the network by supplying a crafted filename, which may lead to arbitrary file inclusion. Successful exploitation, which requires user interaction and presents high attack complexity, can result in disclosure of sensitive information along with modification or deletion of data.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/userpro-messaging/vulnerability/wordpress-private-messages-for-userpro-plugin-4-10-0-local-file-inclusion-vulnerability notes the affected plugin versions and serves as the primary source for mitigation guidance.
EPSS for the CVE rose from a low baseline to a peak of 0.0162, indicating emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2711
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in DeluxeThemes Private Messages for UserPro userpro-messaging.This issue affects Private Messages for UserPro: from n/a through <= 4.10.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The CVE describes a remote file inclusion vulnerability in a public-facing WordPress plugin that allows unauthenticated remote attackers to include and execute arbitrary remote files, directly mapping to exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by identifying, reporting, and correcting the specific PHP RFI flaw in the UserPro plugin through timely patching.
Prevents exploitation of the improper filename control by validating and sanitizing user-supplied inputs used in PHP include/require statements.
Enforces secure PHP configuration settings, such as disabling allow_url_include, to restrict remote file inclusion capabilities exploited by this CVE.