CVE-2025-9874

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9874", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-02T21:17:47.445Z", "datePublished": "2025-09-11T07:24:55.823Z", "dateUpdated": "2026-04-08T17:02:48.590Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:48.590Z"}, "affected": [{"vendor": "webcodingplace", "product": "Ultimate Classified Listings", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.6", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Ultimate Classified Listings plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6 via the 'uclwp_dashboard' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "title": "Ultimate Classified Listings <= 1.6 - Authenticated (Contributor+) Local File Inclusion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7cf6421c-7b92-4624-9c8a-2a2ab0ca9b28?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-classified-listings/trunk/classes/class-shortcodes.php#L49"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-classified-listings/tags/1.7/classes/class-shortcodes.php#L49"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "timeline": [{"time": "2025-09-10T18:52:29.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-11T14:00:15.128497Z", "id": "CVE-2025-9874", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:39:16.369Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9874", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-11T14:00:15.128497Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-11T14:02:38.967Z"}}], "cna": {"title": "Ultimate Classified Listings <= 1.6 - Authenticated (Contributor+) Local File Inclusion", "credits": [{"lang": "en", "type": "finder", "value": "Gilang Asra Bilhadi"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "webcodingplace", "product": "Ultimate Classified Listings", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.6"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-10T18:52:29.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7cf6421c-7b92-4624-9c8a-2a2ab0ca9b28?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-classified-listings/trunk/classes/class-shortcodes.php#L49"}, {"url": "https://plugins.trac.wordpress.org/browser/ultimate-classified-listings/tags/1.7/classes/class-shortcodes.php#L49"}], "descriptions": [{"lang": "en", "value": "The Ultimate Classified Listings plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6 via the 'uclwp_dashboard' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:02:48.590Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9874", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:02:48.590Z", "dateReserved": "2025-09-02T21:17:47.445Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-11T07:24:55.823Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Ultimate Classified Listings", "vendor": "webcodingplace", "versions": [{"lessThanOrEqual": "1.6", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Ultimate Classified Listings plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6 via the 'uclwp_dashboard' shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}, {"lang": "es", "value": "El plugin Ultimate Classified Listings para WordPress es vulnerable a la inclusi\u00f3n local de ficheros en todas las versiones hasta la 1.6, ambas inclusive, a trav\u00e9s del shortcode 'uclwp_dashboard'. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador o superior, incluyan y ejecuten ficheros .php arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en esos ficheros. Esto puede usarse para eludir controles de acceso, obtener datos sensibles o lograr la ejecuci\u00f3n de c\u00f3digo en casos donde se puedan subir e incluir tipos de ficheros .php."}], "id": "CVE-2025-9874", "lastModified": "2026-09-26T00:10:00.127", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9874", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-11T14:00:15.128497Z", "version": "2.0.3"}}]}, "published": "2025-09-11T08:15:39.863", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-classified-listings/tags/1.7/classes/class-shortcodes.php#L49"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/ultimate-classified-listings/trunk/classes/class-shortcodes.php#L49"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/7cf6421c-7b92-4624-9c8a-2a2ab0ca9b28?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T19:06:10.564591+00:00", "value": {"mitigation_remediation": ["Upgrade Ultimate Classified Listings to version\u00a01.7 or later, which removes the vulnerable shortcode handling.", "If an upgrade is not immediately possible, deny Contributor and higher roles the ability to create or edit shortcodes, or temporarily disable the uclwp_dashboard shortcode by removing it from the plugin file.", "Apply a web\u2011application firewall rule to reject requests that attempt to load local files via the uclwp_dashboard shortcode, such as blocking paths that contain '..' or other directory traversal characters.", "Ensure the WordPress upload directories and PHP files are protected by proper file permissions and that PHP execution is disabled in non\u2011document\u2011root folders where file inclusion could be abused."], "summary": {"action": "Patch immediately", "impact": "Local code execution"}, "threat_synthesis": {"affected_systems": "All installations of Ultimate Classified Listings for WordPress with versions up to and including 1.6 are impacted. The plugin is distributed by WebCodingPlace and can be found on the WordPress plugin repository. No other versions are listed as affected, but any environment running these vulnerable versions will be susceptible.", "description_and_impact": "The Ultimate Classified Listings plugin is vulnerable to local file inclusion through the uclwp_dashboard shortcode. This vulnerability is a CWE-98 Local File Inclusion flaw. An attacker who has authenticated Contributor-level or higher access can specify any file path that points to a PHP file on the server and have that file included and executed. Because the included code runs with the permissions of the WordPress process, the attacker can bypass existing access controls, read sensitive files, and execute arbitrary PHP, effectively giving code\u2011execution capabilities on the host.", "risk_and_exploitability": "The vulnerability carries a CVSS score of 7.5, indicating high severity, but the EPSS score is below 1\u202f%, suggesting a low but non\u2011zero likelihood of exploitation at the time of this analysis. It is not listed in the CISA KEV catalog. Exploitation requires an authenticated user with Contributor privileges and the ability to insert the malicious shortcode or modify an existing one. Once the attacker provides a file path that points to a PHP file on the server, the code inside that file is executed in the context of the WordPress site, allowing the attacker full access to the underlying file system as the web\u2011server user."}}}}, "created": "2025-09-12T08:03:05.009960+00:00", "updated": "2026-04-21T19:15:26.033547+00:00", "vendors": ["webcodingplace", "webcodingplace$PRODUCT$ultimate_classified_listings", "wordpress", "wordpress$PRODUCT$wordpress"]}