Local File Inclusion Vulnerability in LT Unleashed Plugin for WordPress

CVE-2025-13886

What is CVE-2025-13886?

The LT Unleashed plugin for WordPress contains a vulnerability that allows authenticated users with Contributor-level access or above to exploit the 'template' parameter in the 'book' shortcode. This flaw arises from inadequate path sanitization, potentially enabling malicious users to include and execute arbitrary files on the server. As a result, attackers could execute PHP code contained in those files, thereby allowing bypass of access controls and unauthorized access to sensitive data, including critical files like wp-config.php.

References