PHP Remote File Inclusion in Email Delivery Solved! by Adrian Tobey
CVE-2025-31015

7.5HIGH

Key Information:

Vendor

WordPress
Status
WordPress Smtp Service, Email Delivery Solved! — Mailhawk
Vendor
CVE Published:
11 April 2025

What is CVE-2025-31015?

A vulnerability exists in the Email Delivery Solved! plugin by Adrian Tobey that allows attackers to exploit improper control of filename parameters, leading to PHP Local File Inclusion. This issue permits an attacker to potentially unveil sensitive system files or execute arbitrary PHP code. The plugin version affected by this vulnerability spans from an unspecified release to version 1.3.1. Implementing proper validation and sanitization measures in file handling could mitigate the risks associated with this vulnerability.

Affected Version(s)

WordPress SMTP Service, Email Delivery Solved! — MailHawk <= 1.3.1

References

https://patchstack.com/database/wordpress/plugin/mailhawk...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.