CVE-2025-31082
Published: 01 April 2025
Summary
CVE-2025-31082 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 18.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a PHP Local File Inclusion issue, tracked as CWE-98, that stems from improper control of filenames in include/require statements within the InfornWeb News & Blog Designer Pack WordPress plugin (blog-designer-pack). It affects all versions through 4.0 and carries a CVSS 3.1 score of 8.1.
An unauthenticated remote attacker can supply a crafted filename parameter over the network to force the inclusion of arbitrary local files on the server. Successful exploitation can yield full control over confidentiality, integrity, and availability of the affected WordPress site without requiring user interaction or credentials.
The issue is documented in the Patchstack advisory database, which identifies the affected plugin versions and links to the corresponding vulnerability record for further details on available fixes.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9478
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in InfornWeb News & Blog Designer Pack blog-designer-pack allows PHP Local File Inclusion.This issue affects News & Blog Designer Pack: from n/a through <= 4.0.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.