CVE-2025-15368

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-15368", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-30T16:50:09.043Z", "datePublished": "2026-02-04T13:24:42.212Z", "dateUpdated": "2026-04-08T16:42:59.408Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:59.408Z"}, "affected": [{"vendor": "themeboy", "product": "SportsPress \u2013 Sports Club & League Manager", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.7.26", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'template_name' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included."}], "title": "SportsPress <= 2.7.26 - Authenticated (Contributor+) Local File Inclusion via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/27e40af7-5697-4482-a96d-9216886c363b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/sportspress/tags/2.7.26/includes/class-sp-shortcodes.php#L32"}, {"url": "https://plugins.trac.wordpress.org/browser/sportspress/tags/2.7.26/includes/class-sp-shortcodes.php#L182"}, {"url": "https://plugins.trac.wordpress.org/browser/sportspress/tags/2.7.26/includes/sp-core-functions.php#L68"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3451661%40sportspress&new=3451661%40sportspress&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2026-02-03T19:45:14.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-04T14:32:03.528021Z", "id": "CVE-2025-15368", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T14:32:09.499Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-15368", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-02-04T14:32:03.528021Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-04T14:32:06.239Z"}}], "cna": {"title": "SportsPress <= 2.7.26 - Authenticated (Contributor+) Local File Inclusion via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "themeboy", "product": "SportsPress \u2013 Sports Club & League Manager", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.7.26"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2026-02-03T19:45:14.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/27e40af7-5697-4482-a96d-9216886c363b?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/sportspress/tags/2.7.26/includes/class-sp-shortcodes.php#L32"}, {"url": "https://plugins.trac.wordpress.org/browser/sportspress/tags/2.7.26/includes/class-sp-shortcodes.php#L182"}, {"url": "https://plugins.trac.wordpress.org/browser/sportspress/tags/2.7.26/includes/sp-core-functions.php#L68"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3451661%40sportspress&new=3451661%40sportspress&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'template_name' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T16:42:59.408Z"}}}, "cveMetadata": {"cveId": "CVE-2025-15368", "state": "PUBLISHED", "dateUpdated": "2026-04-08T16:42:59.408Z", "dateReserved": "2025-12-30T16:50:09.043Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2026-02-04T13:24:42.212Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "SportsPress \u2013 Sports Club & League Manager", "vendor": "themeboy", "versions": [{"lessThanOrEqual": "2.7.26", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The SportsPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.7.26 via shortcodes 'template_name' attribute. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included."}, {"lang": "es", "value": "El plugin SportsPress para WordPress es vulnerable a inclusi\u00f3n local de ficheros en todas las versiones hasta la 2.7.26, inclusive, a trav\u00e9s del atributo 'template_name' de los shortcodes. Esto hace posible que atacantes autenticados, con permisos de nivel de colaborador y superiores, incluyan y ejecuten ficheros arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en esos ficheros. Esto puede usarse para eludir los controles de acceso, obtener datos sensibles o lograr la ejecuci\u00f3n de c\u00f3digo en casos donde se pueda subir e incluir un fichero de tipo PHP."}], "id": "CVE-2025-15368", "lastModified": "2026-06-17T08:37:38.250", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15368", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-02-04T14:32:03.528021Z", "version": "2.0.3"}}]}, "published": "2026-02-04T14:16:08.673", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/sportspress/tags/2.7.26/includes/class-sp-shortcodes.php#L182"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/sportspress/tags/2.7.26/includes/class-sp-shortcodes.php#L32"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/sportspress/tags/2.7.26/includes/sp-core-functions.php#L68"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3451661%40sportspress&new=3451661%40sportspress&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/27e40af7-5697-4482-a96d-9216886c363b?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T15:32:36.685011+00:00", "value": {"mitigation_remediation": ["Upgrade the SportsPress plugin to version 2.7.27 or later to eliminate the vulnerable shortcode handling logic.", "If an immediate upgrade is not possible, remove or disable the 'template_name' shortcode attribute by editing the plugin code or using a child theme to override the shortcode rendering.", "Restrict the use of custom shortcodes by reducing contributor-level permissions or by applying a role management plugin that limits the ability to add or edit shortcodes."], "summary": {"action": "Apply Patch", "impact": "Local File Inclusion leading to potential execution of arbitrary PHP code"}, "threat_synthesis": {"affected_systems": "WordPress sites running the SportsPress \u2013 Sports Club & League Manager plugin at versions 2.7.26 or earlier. The plugin is provided by the vendor ThemeBoy and is widely used in community clubs and league websites.", "description_and_impact": "The SportsPress plugin for WordPress contains a Local File Inclusion flaw in all versions up to and including 2.7.26. By supplying a specially crafted value to the shortcode attribute 'template_name', attackers with contributor-level or higher permissions can include arbitrary files from the server\u2019s filesystem and execute PHP code in those files. This vulnerability permits bypassing the normal WordPress access controls, exposing sensitive configuration data, and achieving remote code execution when the target file is under the attacker's control.", "risk_and_exploitability": "The flaw carries a CVSS score of 8.8 and an EPSS score of less than 1%, indicating a high severity but a low probability of exploitation as measured by current threat data. It is not listed in the CISA KEV catalog. Exploitation requires authenticated access at the contributor level or higher, and the attacker must supply a malicious 'template_name' value via a post or comment containing the shortcode. Once included, the file is executed in the context of the web server, enabling full code execution on the host."}}}}, "created": "2026-02-04T21:17:50.253800+00:00", "updated": "2026-04-22T15:45:20.867089+00:00", "vendors": ["themeboy", "themeboy$PRODUCT$sportspress", "wordpress", "wordpress$PRODUCT$wordpress"]}