CVE-2025-31014
Published: 11 April 2025
Summary
CVE-2025-31014 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 16.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-31014 is a PHP Local File Inclusion vulnerability (CWE-98) affecting the Material Dashboard WordPress plugin by Hossein. The flaw stems from improper control of filenames in include/require statements and impacts all versions through 1.4.5, allowing an attacker to supply crafted paths that resolve to arbitrary local files.
An authenticated user with low privileges can trigger the issue remotely, though the attack requires high complexity. Successful exploitation can result in disclosure or execution of sensitive local PHP files, yielding high impact on confidentiality, integrity, and availability.
The Patchstack advisory entry for the plugin documents the affected versions and associated risk scoring. The EPSS score remains flat at a low 0.0186 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10795
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hossein Material Dashboard material-dashboard allows PHP Local File Inclusion.This issue affects Material Dashboard: from n/a through <= 1.4.5.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.