CVE-2025-11746

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11746", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-14T14:23:56.888Z", "datePublished": "2025-10-15T02:26:27.267Z", "dateUpdated": "2026-04-08T16:43:28.503Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:28.503Z"}, "affected": [{"vendor": "8theme", "product": "XStore", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "9.5.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "title": "XStore | Multipurpose WooCommerce Theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a49db7f-62fc-472d-9edf-de5edbe48219?source=cve"}, {"url": "https://xstore.8theme.com/update-history/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "cweId": "CWE-22", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Tran Nguyen Bao Khanh (from VCI - VNPT Cyber Immunity)"}], "timeline": [{"time": "2025-10-14T14:24:23.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-10-15T18:38:58.409877Z", "id": "CVE-2025-11746", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-15T18:39:07.749Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11746", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-10-15T18:38:58.409877Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-15T18:39:03.312Z"}}], "cna": {"title": "XStore | Multipurpose WooCommerce Theme <= 9.5.4 - Authenticated (Subscriber+) Local File Inclusion", "credits": [{"lang": "en", "type": "finder", "value": "Tran Nguyen Bao Khanh (from VCI - VNPT Cyber Immunity)"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "8theme", "product": "XStore", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "9.5.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-14T14:24:23.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a49db7f-62fc-472d-9edf-de5edbe48219?source=cve"}, {"url": "https://xstore.8theme.com/update-history/"}], "descriptions": [{"lang": "en", "value": "The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:43:28.503Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11746", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:43:28.503Z", "dateReserved": "2025-10-14T14:23:56.888Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-10-15T02:26:27.267Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "XStore", "vendor": "8theme", "versions": [{"lessThanOrEqual": "9.5.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}, {"lang": "es", "value": "El tema XStore para WordPress es vulnerable a la inclusi\u00f3n local de ficheros en todas las versiones hasta la 9.5.4, inclusive, a trav\u00e9s de la funci\u00f3n et_ajax_required_plugins_popup(). Esto hace posible que atacantes autenticados, con acceso de nivel Suscriptor y superior, incluyan y ejecuten ficheros .php arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en esos ficheros. Esto puede usarse para eludir controles de acceso, obtener datos sensibles o lograr la ejecuci\u00f3n de c\u00f3digo en casos donde se puedan subir e incluir tipos de ficheros .php."}], "id": "CVE-2025-11746", "lastModified": "2026-10-08T12:10:00.217", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-11746", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-10-15T18:38:58.409877Z", "version": "2.0.3"}}]}, "published": "2025-10-15T03:15:33.377", "references": [{"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/2a49db7f-62fc-472d-9edf-de5edbe48219?source=cve"}, {"source": "security@wordfence.com", "url": "https://xstore.8theme.com/update-history/"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T22:05:22.423258+00:00", "value": {"mitigation_remediation": ["Upgrade the XStore theme to the latest available version (9.5.5 or newer) where the inclusion flaw is fixed.", "If an upgrade cannot be performed immediately, modify the et_ajax_required_plugins_popup function to validate and sanitize the file path parameter, ensuring only allowed directories and extensions are included, or block the endpoint entirely for non-Administrator users.", "Remove or rename any PHP files stored in the theme or plugin directories that should not be executable, and review upload policies to prevent unintended script uploads.", "Monitor the server for unusual file inclusion or execution attempts by reviewing Apache/Nginx logs and WordPress audit logs for the AJAX endpoint usage."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution via Local File Inclusion"}, "threat_synthesis": {"affected_systems": "Vendor 8theme\u2019s XStore WordPress theme, all releases up to and including version 9.5.4. 8theme, XStore, version \u22649.5.4 are impacted.", "description_and_impact": "The XStore theme for WordPress contains a Local File Inclusion vulnerability that can be triggered through the et_ajax_required_plugins_popup function. The flaw allows authenticated users with Subscriber-level access or higher to specify a file path that the theme will include, enabling the execution of arbitrary PHP code residing on the server. This can be used to bypass access controls, exfiltrate sensitive data, or execute arbitrary code, effectively providing attackers with full code execution capabilities on the affected host.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 8.8, indicating a high severity impact if exploited. The EPSS score is below 1%, suggesting a very low exploitation probability, and the issue is not listed in the CISA KEV catalog. The attack requires a web-based vector: the attacker must authenticate to WordPress with at least Subscriber privileges, then send a crafted AJAX request to the et_ajax_required_plugins_popup endpoint that includes an arbitrary local PHP file path."}}}}, "created": "2025-10-20T13:27:14.967677+00:00", "updated": "2026-04-22T22:15:26.350144+00:00", "vendors": ["8theme", "8theme$PRODUCT$xstore", "wordpress", "wordpress$PRODUCT$wordpress"]}