CVE-2025-14475

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14475", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-10T18:24:03.085Z", "datePublished": "2025-12-13T04:31:24.522Z", "dateUpdated": "2026-04-08T16:50:29.974Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:29.974Z"}, "affected": [{"vendor": "nenad-obradovic", "product": "Extensive VC Addons for WPBakery page builder", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.9.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Extensive VC Addons for WPBakery page builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.1 via the `extensive_vc_get_module_template_part` function. This is due to insufficient path normalization and validation of the user-supplied `shortcode_name` parameter in the `extensive_vc_init_shortcode_pagination` AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files via the `shortcode_name` parameter."}], "title": "Extensive VC Addons for WPBakery page builder <= 1.9.1 - Unauthenticated Local File Inclusion via 'shortcode_name' Parameter", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/49711408-5d04-4fdd-a6c4-b224959ba1bc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/trunk/lib/helpers-functions.php#L78"}, {"url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/lib/helpers-functions.php#L78"}, {"url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/trunk/shortcodes/shortcodes-functions.php#L122"}, {"url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/shortcodes/shortcodes-functions.php#L122"}, {"url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/trunk/shortcodes/shortcodes-functions.php#L142"}, {"url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/shortcodes/shortcodes-functions.php#L142"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Naoya Takahashi"}], "timeline": [{"time": "2025-12-12T16:05:09.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:21:13.970135Z", "id": "CVE-2025-14475", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:34:14.570Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14475", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-12-15T15:21:13.970135Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:21:15.914Z"}}], "cna": {"title": "Extensive VC Addons for WPBakery page builder <= 1.9.1 - Unauthenticated Local File Inclusion via 'shortcode_name' Parameter", "credits": [{"lang": "en", "type": "finder", "value": "Naoya Takahashi"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "nenad-obradovic", "product": "Extensive VC Addons for WPBakery page builder", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.9.1"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-12T16:05:09.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/49711408-5d04-4fdd-a6c4-b224959ba1bc?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/trunk/lib/helpers-functions.php#L78"}, {"url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/lib/helpers-functions.php#L78"}, {"url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/trunk/shortcodes/shortcodes-functions.php#L122"}, {"url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/shortcodes/shortcodes-functions.php#L122"}, {"url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/trunk/shortcodes/shortcodes-functions.php#L142"}, {"url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/shortcodes/shortcodes-functions.php#L142"}], "descriptions": [{"lang": "en", "value": "The Extensive VC Addons for WPBakery page builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.1 via the `extensive_vc_get_module_template_part` function. This is due to insufficient path normalization and validation of the user-supplied `shortcode_name` parameter in the `extensive_vc_init_shortcode_pagination` AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files via the `shortcode_name` parameter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:50:29.974Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14475", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:50:29.974Z", "dateReserved": "2025-12-10T18:24:03.085Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-13T04:31:24.522Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Extensive VC Addons for WPBakery page builder", "vendor": "nenad-obradovic", "versions": [{"lessThanOrEqual": "1.9.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Extensive VC Addons for WPBakery page builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9.1 via the `extensive_vc_get_module_template_part` function. This is due to insufficient path normalization and validation of the user-supplied `shortcode_name` parameter in the `extensive_vc_init_shortcode_pagination` AJAX action. This makes it possible for unauthenticated attackers to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files via the `shortcode_name` parameter."}, {"lang": "es", "value": "El plugin Extensive VC Addons para el constructor de p\u00e1ginas WPBakery para WordPress es vulnerable a inclusi\u00f3n local de ficheros en todas las versiones hasta la 1.9.1, inclusive, a trav\u00e9s de la funci\u00f3n 'extensive_vc_get_module_template_part'. Esto se debe a una normalizaci\u00f3n y validaci\u00f3n de rutas insuficientes del par\u00e1metro 'shortcode_name' proporcionado por el usuario en la acci\u00f3n AJAX 'extensive_vc_init_shortcode_pagination'. Esto hace posible que atacantes no autenticados incluyan y ejecuten ficheros PHP arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en esos ficheros a trav\u00e9s del par\u00e1metro 'shortcode_name'."}], "id": "CVE-2025-14475", "lastModified": "2026-10-07T20:10:01.970", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-14475", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-12-15T15:21:13.970135Z", "version": "2.0.3"}}]}, "published": "2025-12-13T16:16:50.477", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/lib/helpers-functions.php#L78"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/shortcodes/shortcodes-functions.php#L122"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/tags/1.9.1/shortcodes/shortcodes-functions.php#L142"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/trunk/lib/helpers-functions.php#L78"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/trunk/shortcodes/shortcodes-functions.php#L122"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/extensive-vc-addon/trunk/shortcodes/shortcodes-functions.php#L142"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/49711408-5d04-4fdd-a6c4-b224959ba1bc?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T17:15:40.872304+00:00", "value": {"mitigation_remediation": ["Upgrade the Extensive VC Addons for WPBakery page builder plugin to the latest available version, which removes the LFI flaw.", "If upgrading is not immediately possible, disable or restrict access to the \"extensive_vc_init_shortcode_pagination\" AJAX action through WordPress settings or by removing the Shortcode feature from the plugin configuration.", "Apply network or web server rules (e.g., .htaccess, firewall) to block unauthenticated access to the plugin\u2019s AJAX endpoint, preventing exploitation until a patch is deployed."], "summary": {"action": "Immediate Patch", "impact": "Remote Code Execution"}, "threat_synthesis": {"affected_systems": "All installations of the Extensive VC Addons for WPBakery page builder plugin up to and including version 1.9.1 are impacted. The vulnerability exists in the plugin code that runs within the WordPress environment and is triggered via standard plugin URLs accessed by any visitor.", "description_and_impact": "The Vulnerable plugin performs a local file inclusion without normalizing the user-supplied \"shortcode_name\" argument in an AJAX action, allowing an unauthenticated attacker to include and execute arbitrary PHP files present on the server. This capability turns the plugin into a conduit for arbitrary code execution, effectively giving the attacker full control over the affected WordPress installation. The weakness is identified as CWE-98.", "risk_and_exploitability": "The CVSS score of 8.1 reflects high severity, while the EPSS score of less than 1 percent indicates low exploitation probability as of the time of analysis. The defect is not listed in the CISA KEV catalog. The primary attack vector is the publicly available AJAX endpoint \"extensive_vc_init_shortcode_pagination\", which an attacker can call without authentication, supply a crafted \"shortcode_name\" value, and thereby include malicious server-side files. Only a component with file system write access or an attacker already able to place files on the web root would be fully exploited, but the LFI flaw itself allows arbitrary code execution if such files exist."}}}}, "created": "2025-12-14T21:14:56.468278+00:00", "updated": "2026-04-21T17:30:37.682903+00:00", "vendors": ["nenad-obradovic", "nenad-obradovic$PRODUCT$extensive_vc_addons_for_wpbakery_page_builder", "wordpress", "wordpress$PRODUCT$wordpress"]}