CVE-2025-31016
Published: 31 March 2025
Summary
CVE-2025-31016 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-31016 is a PHP Local File Inclusion vulnerability arising from improper control of filenames in include or require statements. It affects the Crocoblock JetWooBuilder plugin for WordPress, specifically all versions through 2.1.18. The flaw is tracked under CWE-98 and carries a CVSS 3.1 score of 7.5.
An attacker with low-privileged network access can exploit the issue, though the attack requires high complexity. Successful exploitation allows the attacker to include arbitrary local files, resulting in high impact to confidentiality, integrity, and availability on the affected WordPress site.
The vulnerability is documented in the Patchstack database, which provides the canonical advisory and version information for JetWooBuilder.
The associated EPSS score remains low, with a current value of 0.0109 and a peak of 0.0159.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8708
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Crocoblock JetWooBuilder jet-woo-builder allows PHP Local File Inclusion.This issue affects JetWooBuilder: from n/a through <= 2.1.18.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress plugin enables exploitation of public-facing applications (T1190) and direct access to local system files for data disclosure (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely identification, reporting, and correction of the LFI flaw in JetWooBuilder plugin versions <=2.1.18 to eliminate the vulnerability.
Mandates validation of user-supplied filenames in PHP include/require statements to block malicious local file inclusion paths.
Enforces secure PHP configuration settings like open_basedir restrictions and disabled risky functions to limit file inclusion capabilities exploited by this LFI vulnerability.