PHP Remote File Inclusion Vulnerability in WebCodingPlace Responsive Posts Carousel Plugin
CVE-2025-52728

7.5HIGH

Key Information:

Vendor

WordPress
Status
Responsive Posts Carousel WordPress Plugin
Vendor
CVE Published:
14 August 2025

What is CVE-2025-52728?

A vulnerability in the WebCodingPlace Responsive Posts Carousel plugin allows an attacker to exploit improper control of filename for PHP Include/Require statements. This results in PHP Local File Inclusion, potentially allowing unauthorized access to sensitive files on the server. This affects all versions of the plugin up to 15.0, making it essential for users to update to secure versions to mitigate the risk.

Affected Version(s)

Responsive Posts Carousel WordPress Plugin <= 15.0

References

https://patchstack.com/database/wordpress/plugin/responsi...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Tran Nguyen Bao Khanh (VCI - VNPT Cyber Immunity) (Patchstack Alliance)
.