Local File Inclusion Vulnerability in Premium Portfolio Features for Phlox Theme Plugin by WordPress

CVE-2025-12497

What is CVE-2025-12497?

The Premium Portfolio Features for Phlox theme plugin for WordPress is susceptible to Local File Inclusion through the 'args[extra_template_path]' parameter. This vulnerability allows unauthenticated attackers to include and execute arbitrary PHP files on the server. By exploiting this flaw, malicious actors can bypass access controls, access sensitive data, and execute arbitrary PHP code, posing significant security risks to affected WordPress sites.

References