CVE-2025-12851

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12851", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-11-06T23:45:33.325Z", "datePublished": "2025-12-05T09:27:00.893Z", "dateUpdated": "2026-04-08T16:41:12.056Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:12.056Z"}, "affected": [{"vendor": "wphocus", "product": "My auctions allegro", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "3.6.32", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The My auctions allegro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.32 via the 'controller' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included."}], "title": "My auctions allegro <= 3.6.32 - Unauthenticated Local File Inclusion via controller", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/202a8493-6df0-4a5e-b6bf-099219830e01?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3402268/my-auctions-allegro-free-edition"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "timeline": [{"time": "2025-11-07T00:00:59.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-04T20:41:27.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-05T12:52:56.259009Z", "id": "CVE-2025-12851", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T12:53:13.818Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12851", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-05T12:52:56.259009Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-05T12:53:10.055Z"}}], "cna": {"title": "My auctions allegro <= 3.6.32 - Unauthenticated Local File Inclusion via controller", "credits": [{"lang": "en", "type": "finder", "value": "M Indra Purnama"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "wphocus", "product": "My auctions allegro", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "3.6.32"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-07T00:00:59.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-04T20:41:27.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/202a8493-6df0-4a5e-b6bf-099219830e01?source=cve"}, {"url": "https://plugins.trac.wordpress.org/changeset/3402268/my-auctions-allegro-free-edition"}], "descriptions": [{"lang": "en", "value": "The My auctions allegro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.32 via the 'controller' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:41:12.056Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12851", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:41:12.056Z", "dateReserved": "2025-11-06T23:45:33.325Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-05T09:27:00.893Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "My auctions allegro", "vendor": "wphocus", "versions": [{"lessThanOrEqual": "3.6.32", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The My auctions allegro plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 3.6.32 via the 'controller' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \u201csafe\u201d file types can be uploaded and included."}, {"lang": "es", "value": "El plugin My auctions allegro para WordPress es vulnerable a Inclusi\u00f3n local de ficheros en todas las versiones hasta la 3.6.32, inclusive, a trav\u00e9s del par\u00e1metro 'controller'. Esto hace posible que atacantes no autenticados incluyan y ejecuten ficheros arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en esos ficheros. Esto puede usarse para eludir los controles de acceso, obtener datos sensibles o lograr la ejecuci\u00f3n de c\u00f3digo en casos donde im\u00e1genes y otros tipos de ficheros 'seguros' pueden ser subidos e incluidos."}], "id": "CVE-2025-12851", "lastModified": "2026-09-25T23:10:00.463", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12851", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-05T12:52:56.259009Z", "version": "2.0.3"}}]}, "published": "2025-12-05T10:15:45.530", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3402268/my-auctions-allegro-free-edition"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/202a8493-6df0-4a5e-b6bf-099219830e01?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T16:23:46.041996+00:00", "value": {"mitigation_remediation": ["Upgrade the My auctions allegro plugin to the latest version that removes the LFI flaw.", "If an upgrade is not immediately possible, disable or delete the plugin from the WordPress installation.", "Configure web application firewall rules to block requests containing suspicious \u2018controller\u2019 values or arbitrary file paths."], "summary": {"action": "Immediate Patch", "impact": "Remote code execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the WordPress plugin \"My auctions allegro\" from the vendor wphocus, versions 3.6.32 and earlier. Only WordPress sites that have this plugin installed are at risk.", "description_and_impact": "The My auctions allegro plugin for WordPress allows an attacker to include and execute arbitrary files on the server through the unvalidated 'controller' parameter. This local file inclusion flaw can be exploited by unauthenticated users to run PHP code, bypass access controls, and exfiltrate sensitive data. The impact is full code execution on the affected host, granting attackers control over the system and the ability to compromise the entire WordPress installation.", "risk_and_exploitability": "The flaw carries a CVSS score of 8.1, indicating high severity, but the EPSS score is below 1%, suggesting a low current exploitation probability. The vulnerability is not listed in the CISA KEV catalog. Attackers can trigger the flaw remotely by sending a crafted HTTP request containing a malicious value for the 'controller' parameter; no authentication is required. Successful exploitation results in execution of arbitrary PHP code, enabling full compromise of the WordPress site."}}}}, "created": "2025-12-05T20:56:22.696274+00:00", "updated": "2026-04-22T16:30:22.140163+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress", "wphocus", "wphocus$PRODUCT$my_auctions_allegro"]}