CVE-2025-9991

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-9991", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-09-04T14:15:12.637Z", "datePublished": "2025-09-30T03:35:31.476Z", "dateUpdated": "2026-04-08T17:19:45.615Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:19:45.615Z"}, "affected": [{"vendor": "migli", "product": "Tiny Bootstrap Elements Light", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.3.34", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Tiny Bootstrap Elements Light plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.3.34 via the 'language' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "title": "Tiny Bootstrap Elements Light <= 4.3.34 - Unauthenticated Local File Inclusion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c1010470-63d4-49c5-9811-0e86fbeb57d5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tiny-bootstrap-elements-light/trunk/assets/bootstrap-label.php#L14"}, {"url": "https://plugins.svn.wordpress.org/tiny-bootstrap-elements-light/trunk/assets/bootstrap-label.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 8.1, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Aril Aprilio"}], "timeline": [{"time": "2025-09-29T15:27:14.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-30T15:35:11.558076Z", "id": "CVE-2025-9991", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T15:35:21.042Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-9991", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-09-30T15:35:11.558076Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T15:35:17.792Z"}}], "cna": {"title": "Tiny Bootstrap Elements Light <= 4.3.34 - Unauthenticated Local File Inclusion", "credits": [{"lang": "en", "type": "finder", "value": "Aril Aprilio"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "migli", "product": "Tiny Bootstrap Elements Light", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "4.3.34"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-09-29T15:27:14.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c1010470-63d4-49c5-9811-0e86fbeb57d5?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/tiny-bootstrap-elements-light/trunk/assets/bootstrap-label.php#L14"}, {"url": "https://plugins.svn.wordpress.org/tiny-bootstrap-elements-light/trunk/assets/bootstrap-label.php"}], "descriptions": [{"lang": "en", "value": "The Tiny Bootstrap Elements Light plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.3.34 via the 'language' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:19:45.615Z"}}}, "cveMetadata": {"cveId": "CVE-2025-9991", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:19:45.615Z", "dateReserved": "2025-09-04T14:15:12.637Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-30T03:35:31.476Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Tiny Bootstrap Elements Light", "vendor": "migli", "versions": [{"lessThanOrEqual": "4.3.34", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Tiny Bootstrap Elements Light plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.3.34 via the 'language' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}, {"lang": "es", "value": "El plugin Tiny Bootstrap Elements Light para WordPress es vulnerable a la inclusi\u00f3n local de ficheros en todas las versiones hasta la 4.3.34, inclusive, a trav\u00e9s del par\u00e1metro 'language'. Esto hace posible que atacantes no autenticados incluyan y ejecuten ficheros .php arbitrarios en el servidor, permitiendo la ejecuci\u00f3n de cualquier c\u00f3digo PHP en esos ficheros. Esto puede usarse para eludir controles de acceso, obtener datos sensibles o lograr la ejecuci\u00f3n de c\u00f3digo en casos donde se puedan subir e incluir tipos de ficheros .php."}], "id": "CVE-2025-9991", "lastModified": "2026-06-17T10:10:12.987", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-9991", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-09-30T15:35:11.558076Z", "version": "2.0.3"}}]}, "published": "2025-09-30T11:37:47.770", "references": [{"source": "security@wordfence.com", "url": "https://plugins.svn.wordpress.org/tiny-bootstrap-elements-light/trunk/assets/bootstrap-label.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/tiny-bootstrap-elements-light/trunk/assets/bootstrap-label.php#L14"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c1010470-63d4-49c5-9811-0e86fbeb57d5?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:26:10.379816+00:00", "value": {"mitigation_remediation": ["Upgrade the Tiny Bootstrap Elements Light plugin to version 4.3.35 or newer to remove the vulnerable inclusion code.", "If an upgrade is not immediately possible, disable or block access to the bootstrap-label.php file or configure the server to reject include attempts that use the 'language' parameter, thereby preventing LFI exploitation.", "Review the site\u2019s file upload and permission settings to ensure that PHP files cannot be written or executed by unauthenticated users, and consider implementing a web application firewall to block malicious inclusion attempts."], "summary": {"action": "Patch Immediately", "impact": "Local File Inclusion leading to arbitrary PHP execution"}, "threat_synthesis": {"affected_systems": "Any WordPress installation that has the Tiny Bootstrap Elements Light plugin version 4.3.34 or earlier installed is affected. The vulnerability is triggered by the \"language\" parameter present in the plugin\u2019s bootstrap-label.php script, which all users can reach via normal site URLs.", "description_and_impact": "The Tiny Bootstrap Elements Light plugin for WordPress contains a Local File Inclusion flaw (CWE-98) that allows an attacker to specify an arbitrary \"language\" parameter and include any PHP file from the server. This can result in executing arbitrary PHP code, bypassing access controls, accessing sensitive data, or fully compromising the WordPress site. The flaw exists in all versions up to and including 4.3.34 and does not require authentication, making it particularly dangerous.", "risk_and_exploitability": "The CVSS score of 8.1 reflects a high severity impact, though the EPSS score of less than 1% indicates a low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog, but unauthenticated attackers can exploit it by crafting a request to the vulnerable parameter, potentially achieving code execution if they can upload or otherwise provide PHP content that the server will include. The lack of authentication requirements expands the potential attacker base, warranting immediate attention."}}}}, "created": "2025-09-30T08:47:17.634911+00:00", "updated": "2026-04-20T19:30:06.167953+00:00", "vendors": ["migli", "migli$PRODUCT$tiny_bootstrap_elements_light", "wordpress", "wordpress$PRODUCT$wordpress"]}