Local File Inclusion Vulnerability in Ultimate Classified Listings Plugin for WordPress

CVE-2025-9874

What is CVE-2025-9874?

The Ultimate Classified Listings plugin for WordPress is prone to a Local File Inclusion vulnerability that impacts all versions up to and including 1.6. This flaw allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary PHP files from the server through the 'uclwp_dashboard' shortcode. Successful exploitation could lead to unauthorized access, data leakage, and remote code execution, enabling attackers to bypass access controls or escalate their privileges.

References