Local File Inclusion Vulnerability in LT Unleashed Plugin for WordPress

CVE-2025-13886

What is CVE-2025-13886?

The LT Unleashed plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level access or above to exploit the 'template' parameter in the 'book' shortcode. This flaw arises from inadequate path sanitization, potentially enabling malicious users to include and execute arbitrary files on the server. As a result, attackers could execute PHP code contained in those files, thereby allowing bypass of access controls and unauthorized access to sensitive data, including critical files like wp-config.php.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References