PHP Local File Inclusion Vulnerability in Pop-Up Chop Chop by WordPress
CVE-2025-31432

7.5HIGH

Key Information:

Vendor

WordPress
Status
Pop-up Chop Chop
Vendor
CVE Published:
28 March 2025

What is CVE-2025-31432?

The Pop-Up Chop Chop plugin for WordPress is vulnerable to PHP Local File Inclusion due to improper control of filename inputs in include/require statements. This vulnerability can potentially allow attackers to access sensitive files on the server, leading to unauthorized data exposure. Users of Pop-Up Chop Chop versions up to 2.1.7 are particularly at risk, emphasizing the importance of updating the plugin to secure their sites against potential exploitation.

Affected Version(s)

Pop-Up Chop Chop <= 2.1.7

References

https://patchstack.com/database/wordpress/plugin/pop-up/v...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Nguyen Xuan Chien (Patchstack Alliance)
.