CVE-2025-31097
Published: 01 April 2025
Summary
CVE-2025-31097 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 16.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a PHP Local File Inclusion issue (CWE-98) stemming from improper control of filenames in include/require statements. It affects the Material Dashboard WordPress plugin by Hossein, with all versions through 1.4.5 impacted.
An unauthenticated remote attacker can exploit the flaw over the network without user interaction. Successful exploitation allows inclusion of arbitrary local files, which can result in disclosure of sensitive information, modification of data, or full compromise of the affected application with high impact to confidentiality, integrity, and availability.
The issue is documented in the Patchstack advisory for the WordPress plugin, which identifies the Local File Inclusion vulnerability in version 1.4.5 and earlier. The EPSS score remains low, with a current value of 0.0194 and a peak of 0.0253.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9464
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hossein Material Dashboard material-dashboard allows PHP Local File Inclusion.This issue affects Material Dashboard: from n/a through <= 1.4.5.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.