CVE-2025-9991
Published: 30 September 2025
Summary
CVE-2025-9991 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 44.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-9991 is a Local File Inclusion (LFI) vulnerability in the Tiny Bootstrap Elements Light plugin for WordPress, affecting all versions up to and including 4.3.34. The flaw arises via the 'language' parameter, which allows unauthenticated attackers to include and execute arbitrary .php files on the server. This issue is classified as CWE-98 and carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity due to potential impacts on confidentiality, integrity, and availability.
Unauthenticated attackers can exploit this vulnerability remotely with high attack complexity and no user interaction or privileges required. Successful exploitation enables the inclusion and execution of arbitrary PHP code from included files, which can be used to bypass access controls, obtain sensitive data, or achieve code execution, particularly in scenarios where .php file types can be uploaded to the server.
Advisories reference the vulnerable code in the plugin's bootstrap-label.php file, accessible via WordPress plugin SVN and Trac repositories (e.g., line 14), along with a Wordfence threat intelligence page detailing the issue (ID: c1010470-63d4-49c5-9811-0e86fbeb57d5). No specific patch details are outlined beyond implying updates beyond version 4.3.34.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-31682
Vulnerability details
The Tiny Bootstrap Elements Light plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.3.34 via the 'language' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files…
more
on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress plugin directly enables remote unauthenticated exploitation for file inclusion and code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the LFI vulnerability by requiring validation of the untrusted 'language' parameter to prevent path traversal and arbitrary PHP file inclusion.
Remediates the specific flaw in the Tiny Bootstrap Elements Light plugin by identifying, prioritizing, and applying updates to versions beyond 4.3.34.
Provides boundary protection via web application firewalls or proxies that can inspect and block LFI payloads targeting the 'language' parameter in unauthenticated requests.