PHP Remote File Inclusion Vulnerability in Lomu WPCOM Member Plugin

CVE-2025-39570

What is CVE-2025-39570?

The vulnerability in Lomu WPCOM Member involves improper control of filenames used in the include/require statements in PHP. This flaw allows an attacker to exploit local file inclusion vulnerabilities, potentially compromising the security of the web application. Affected versions of WPCOM Member are vulnerable to unauthorized access to sensitive files, which can lead to further exploitation and risks in the server environment.

References