Local File Inclusion Vulnerability in SportsPress Plugin for WordPress

CVE-2025-15368

What is CVE-2025-15368?

The SportsPress plugin for WordPress is susceptible to a Local File Inclusion vulnerability, which affects all versions up to and including 2.7.26. By manipulating the 'template_name' attribute within shortcodes, authenticated users with contributor-level permissions and higher can include and execute unauthorized files located on the server. This exploitation enables attackers to bypass established access controls, potentially leading to data theft or unauthorized code execution, especially if PHP files can be uploaded and included.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References