Local File Inclusion Vulnerability in PublishPress Authors Plugin by PublishPress
CVE-2025-47496

7.5HIGH

Key Information:

Vendor

WordPress
Status
PublisHPress Authors
Vendor
CVE Published:
7 May 2025

What is CVE-2025-47496?

The PublishPress Authors plugin is susceptible to a Local File Inclusion vulnerability due to improper control over filenames used in include/require statements. This flaw allows attackers to manipulate file paths, potentially leading to unauthorized access to sensitive files on the server. It is crucial for users of PublishPress Authors, particularly those on version 4.7.5 and earlier, to take immediate action to secure their applications against this vulnerability to prevent exploitation.

Affected Version(s)

PublishPress Authors 0 <= 4.7.5

References

https://patchstack.com/database/Wordpress/Plugin/publishp...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

muhammad yudha (Patchstack Alliance)
.