Cyber Resilience

CVE-2025-49036

High

Published: 14 August 2025

Published
14 August 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0050 66.6th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-49036 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 33.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-49036 is an Improper Control of Filename for Include/Require Statement vulnerability, known as PHP Remote File Inclusion, that enables PHP Local File Inclusion (CWE-98) in the Premium Addons for KingComposer WordPress plugin from octagonwebstudio. The issue affects all versions of the plugin from n/a through 1.1.1 inclusive. It has a CVSS v3.1 base score of 8.1 (High), with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, high attack complexity, no privileges or user interaction required, and high impacts across confidentiality, integrity, and availability.

Unauthenticated remote attackers can exploit this vulnerability over the network to perform local file inclusion on affected WordPress sites running vulnerable plugin versions. By manipulating filenames in PHP include/require statements, attackers can include arbitrary local files, potentially leading to sensitive data disclosure, arbitrary code execution if PHP files are targeted, or denial of service through file access disruptions.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/premium-addons-for-kingcomposer/vulnerability/wordpress-premium-addons-for-kingcomposer-plugin-1-1-1-local-file-inclusion-vulnerability?_s_id=cve provides details on this Local File Inclusion vulnerability in Premium Addons for KingComposer version 1.1.1, including recommended mitigations for WordPress administrators.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in octagonwebstudio Premium Addons for KingComposer premium-addons-for-kingcomposer allows PHP Local File Inclusion.This issue affects Premium Addons for KingComposer: from n/a through <= 1.1.1.

CWE(s)
CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

LFI vulnerability in public-facing WordPress plugin directly enables remote exploitation of the web application for code execution or data access.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-28087Shared CWE-98
CVE-2025-23952Shared CWE-98
CVE-2026-32505Shared CWE-98
CVE-2025-48149Shared CWE-98
CVE-2025-60058Shared CWE-98
CVE-2025-49994Shared CWE-98
CVE-2026-24531Shared CWE-98
CVE-2025-67527Shared CWE-98
CVE-2025-69396Shared CWE-98
CVE-2025-62067Shared CWE-98

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly mitigates improper filename control in PHP include/require statements by enforcing input validation to block malicious local file inclusion paths.

SI-2 Flaw Remediation good match
prevent

Ensures timely remediation of the specific LFI flaw in Premium Addons for KingComposer plugin versions <=1.1.1 through patching or removal.

RA-5 Vulnerability Monitoring and Scanning partial match
detect

Enables detection of the vulnerable plugin via regular vulnerability scanning, allowing proactive mitigation before exploitation.

References