CVE-2025-46474
Published: 23 May 2025
Summary
CVE-2025-46474 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 15.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-46474 is a PHP Local File Inclusion vulnerability, tracked under CWE-98, that stems from improper control of filenames in include or require statements. It affects the SEUR Oficial WordPress plugin, versions from n/a through 2.2.23, and carries a CVSS 3.1 score of 8.1 reflecting network attack vector, high complexity, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can exploit the flaw over the network to include and execute arbitrary local files on the server. Successful exploitation can lead to disclosure of sensitive information, modification of application behavior, or full compromise of the affected WordPress site.
The vulnerability is documented in the Patchstack database, which lists the affected plugin versions and provides the primary advisory reference for further details on detection and remediation. The associated EPSS score remains flat at 0.0206 with no material increase observed since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-28051
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in SEUR OFICIAL SEUR Oficial seur allows PHP Local File Inclusion.This issue affects SEUR Oficial: from n/a through <= 2.2.23.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.