PHP Remote File Inclusion Vulnerability in AndonDesign UDesign Core Plugin
CVE-2025-63062

7.6HIGH

Key Information:

Vendor

WordPress
Status
Udesign Core
Vendor
CVE Published:
9 December 2025

What is CVE-2025-63062?

The UDesign Core plugin developed by AndonDesign is susceptible to a PHP Local File Inclusion (LFI) vulnerability due to improper control of filenames in include/require statements. This flaw allows an attacker to manipulate PHP scripts to include unwanted files, which could potentially lead to unauthorized access or complete compromise of the web application. Affected versions of the plugin range from earlier versions to 4.14.0. It is crucial for users of the UDesign Core plugin to review their installations and apply the necessary updates to mitigate this risk.

Affected Version(s)

UDesign Core <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/u-de...
vdb-entry

CVSS V3.1

Score:
7.6
Severity:
HIGH
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

João Pedro S Alcântara (Kinorth) | Patchstack Bug Bounty Program
JSON
.