CVE-2025-1707

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-1707", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-02-26T05:45:57.368Z", "datePublished": "2025-03-11T21:21:12.899Z", "dateUpdated": "2026-04-08T17:11:14.337Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:14.337Z"}, "affected": [{"vendor": "techlabpro1", "product": "Review Schema \u2013 Review & Structure Data Schema Plugin", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "2.2.4", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Review Schema plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.4 via post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included."}], "title": "Review Schema <= 2.2.4 - Authenticated (Contributor+) Local File Inclusion via Post Meta", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9b4de243-d337-4f29-a766-bcafb3848d1c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/review-schema/tags/2.2.4/app/Shortcodes/ReviewSchema.php#L108"}, {"url": "https://plugins.trac.wordpress.org/changeset/3253799/review-schema"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "timeline": [{"time": "2025-02-26T00:00:00.000Z", "lang": "en", "value": "Discovered"}, {"time": "2025-02-26T00:00:00.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-03-11T00:00:00.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-03-12T14:06:22.763610Z", "id": "CVE-2025-1707", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-12T14:06:30.498Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-1707", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-03-12T14:06:22.763610Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-12T14:06:27.240Z"}}], "cna": {"title": "Review Schema <= 2.2.4 - Authenticated (Contributor+) Local File Inclusion via Post Meta", "credits": [{"lang": "en", "type": "finder", "value": "Istv\u00e1n M\u00e1rton"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "techlabpro1", "product": "Review Schema \u2013 Review & Structure Data Schema Plugin", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "2.2.4"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-02-26T00:00:00.000Z", "value": "Discovered"}, {"lang": "en", "time": "2025-02-26T00:00:00.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-03-11T00:00:00.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9b4de243-d337-4f29-a766-bcafb3848d1c?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/review-schema/tags/2.2.4/app/Shortcodes/ReviewSchema.php#L108"}, {"url": "https://plugins.trac.wordpress.org/changeset/3253799/review-schema"}], "descriptions": [{"lang": "en", "value": "The Review Schema plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.4 via post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:14.337Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1707", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:11:14.337Z", "dateReserved": "2025-02-26T05:45:57.368Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-03-11T21:21:12.899Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Review Schema \u2013 Review & Structure Data Schema Plugin", "vendor": "techlabpro1", "versions": [{"lessThanOrEqual": "2.2.4", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Review Schema plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.2.4 via post meta. This makes it possible for authenticated attackers, with contributor-level and above permissions, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where php file type can be uploaded and included."}, {"lang": "es", "value": "El complemento Review Schema para WordPress es vulnerable a la inclusi\u00f3n local de archivos en todas las versiones hasta la 2.2.4 incluida, mediante metadatos de entrada. Esto permite a atacantes autenticados, con permisos de colaborador o superiores, incluir y ejecutar archivos arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en dichos archivos. Esto puede utilizarse para eludir los controles de acceso, obtener datos confidenciales o ejecutar c\u00f3digo cuando se permite subir e incluir archivos PHP."}], "id": "CVE-2025-1707", "lastModified": "2026-06-17T08:39:38.423", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-1707", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-03-12T14:06:22.763610Z", "version": "2.0.3"}}]}, "published": "2025-03-11T22:15:12.583", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/review-schema/tags/2.2.4/app/Shortcodes/ReviewSchema.php#L108"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3253799/review-schema"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9b4de243-d337-4f29-a766-bcafb3848d1c?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T22:00:49.244904+00:00", "value": {"mitigation_remediation": ["Upgrade the Review Schema plugin to a version beyond 2.2.4, where the vulnerable inclusion mechanism has been removed.", "If an immediate upgrade is not possible, disable the shortcodes or filters that trigger the include logic or restrict contributors from posting content that may invoke them.", "Apply restrictive file permissions to the directories where uploads are stored, ensuring that uploaded files cannot be executed, and remove or rename any PHP files that could be included via user input."], "summary": {"action": "Patch Now", "impact": "Local File Inclusion leading to potential code execution for authenticated contributors and above"}, "threat_synthesis": {"affected_systems": "The affected product is the Review Schema \u2013 Review & Structure Data Schema Plugin for WordPress. All versions up to and including 2.2.4 are vulnerable. Users running any of these versions should update to the latest release, which omits the insecure include mechanism.", "description_and_impact": "The vulnerability in the Review Schema WordPress plugin allows authenticated users with contributor-level or higher permissions to trigger a local file inclusion by manipulating post meta. Because the included files can contain PHP code, an attacker can execute arbitrary scripts on the server, potentially bypassing access controls, extracting confidential data, or performing further exploitation. This flaw is a classic instance of CWE\u201198, wherein insecure handling of user-controlled paths leads to inclusion of untrusted files.", "risk_and_exploitability": "The CVSS score of 8.8 classifies this flaw as high severity. The EPSS score is below 1% indicating a low but nonzero probability that exploitation will occur in the wild. The vulnerability is not listed in CISA\u2019s KEV catalog. Because the flaw requires authentication at the contributor level or higher, an attacker must first compromise or become an authenticated account before exploiting the file inclusion. Once authenticated, the attacker can supply arbitrary file paths via post meta and cause the server to execute the targeted PHP code. Given the high impact and the fact that valid user accounts are common in most installations, the risk to affected sites is significant if the flaw remains unpatched."}}}}, "created": "2026-04-21T22:15:45.894764+00:00", "updated": "2026-04-21T22:15:45.894776+00:00", "vendors": []}