CVE-2025-12497

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12497", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-29T23:05:58.113Z", "datePublished": "2025-11-05T11:24:40.177Z", "dateUpdated": "2026-04-08T16:52:33.660Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:33.660Z"}, "affected": [{"vendor": "averta", "product": "Premium Portfolio Features for Phlox theme", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.3.10", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the 'args[extra_template_path]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "title": "Premium Portfolio Features for Phlox theme <= 2.3.10 - Unauthenticated Local File Inclusion via args[extra_template_path]", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/518abad2-d3cc-4d15-83d2-8fd99d30500c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3388727/auxin-portfolio"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "LionTree"}], "timeline": [{"time": "2025-10-29T23:21:49.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-11-04T21:46:49.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-05T14:59:45.275663Z", "id": "CVE-2025-12497", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T15:03:20.522Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12497", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-05T14:59:45.275663Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-05T15:02:07.794Z"}}], "cna": {"title": "Premium Portfolio Features for Phlox theme <= 2.3.10 - Unauthenticated Local File Inclusion via args[extra_template_path]", "credits": [{"lang": "en", "type": "finder", "value": "LionTree"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "averta", "product": "Premium Portfolio Features for Phlox theme", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.3.10"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-10-29T23:21:49.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-11-04T21:46:49.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/518abad2-d3cc-4d15-83d2-8fd99d30500c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3388727/auxin-portfolio"}], "descriptions": [{"lang": "en", "value": "The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the 'args[extra_template_path]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:52:33.660Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12497", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:52:33.660Z", "dateReserved": "2025-10-29T23:05:58.113Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-05T11:24:40.177Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Premium Portfolio Features for Phlox theme", "vendor": "averta", "versions": [{"lessThanOrEqual": "2.3.10", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the 'args[extra_template_path]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}, {"lang": "es", "value": "El plugin Premium Portfolio Features for Phlox theme para WordPress es vulnerable a Inclusi\u00f3n Local de Ficheros en todas las versiones hasta la 2.3.10, inclusive, a trav\u00e9s del par\u00e1metro 'args[extra_template_path]'. Esto posibilita que atacantes no autenticados incluyan y ejecuten ficheros .php arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en esos ficheros. Esto puede utilizarse para eludir los controles de acceso, obtener datos sensibles o lograr la ejecuci\u00f3n de c\u00f3digo en casos donde los tipos de ficheros .php puedan ser cargados e incluidos."}], "id": "CVE-2025-12497", "lastModified": "2026-10-18T21:10:00.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12497", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-11-05T14:59:45.275663Z", "version": "2.0.3"}}]}, "published": "2025-11-05T12:15:33.347", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3388727/auxin-portfolio"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/518abad2-d3cc-4d15-83d2-8fd99d30500c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T11:45:58.116123+00:00", "value": {"mitigation_remediation": ["Upgrade the Premium Portfolio Features for Phlox theme plugin to version 2.4 or later to remove the LFI flaw.", "Disable or remove the\u00a0args[extra_template_path]\u00a0parameter from the public query string, ensuring only privileged users can trigger template loading.", "Block the upload of PHP files to the site\u2019s upload directory by tightening file\u2011type restrictions or moving uploads outside the web root.", "Configure PHP to disallow remote file inclusion by setting\u00a0allow_url_include\u00a0to Off and, if possible, enable\u00a0safe_mode\u00a0to mitigate future LFI attempts."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "WordPress sites using averta\u2019s Premium Portfolio Features for Phlox theme plugin, version\u00a02.3.10 or earlier, remain vulnerable. Sites that have not upgraded beyond these versions are at risk.", "description_and_impact": "The Premium Portfolio Features for Phlox theme plugin contains a local file inclusion flaw in the\u00a0args[extra_template_path]\u00a0parameter. An unauthenticated attacker can supply an arbitrary path to a PHP file, causing the server to include and execute that file. This enables the attacker to bypass access controls, read sensitive data, or run arbitrary PHP code, effectively compromising the affected WordPress installation.", "risk_and_exploitability": "The CVSS score of 8.1 reflects the high impact of remote code execution, while the EPSS score of less than 1% indicates a very low current exploitation probability. The vulnerability is not listed in CISA KEV, but it can be exploited through a simple HTTP request containing the malicious\u00a0args[extra_template_path]\u00a0value. An attacker does not need authentication but must have internet access to the site and the ability to reference a PHP file\u2014either from the local filesystem or an uploaded one that can be included."}}}}, "created": "2025-11-06T10:07:25.216064+00:00", "updated": "2026-04-22T12:00:05.917988+00:00", "vendors": ["averta", "averta$PRODUCT$phlox", "averta$PRODUCT$premium_portfolio_features_for_phlox_theme", "wordpress", "wordpress$PRODUCT$wordpress"]}