Local File Inclusion Vulnerability in Tiny Bootstrap Elements Light Plugin for WordPress

CVE-2025-9991

What is CVE-2025-9991?

The Tiny Bootstrap Elements Light plugin for WordPress has a vulnerability allowing unauthenticated attackers to exploit the 'language' parameter. This Local File Inclusion issue affects all versions up to 4.3.34, enabling attackers to include and execute arbitrary .php files stored on the server. As a result, it can compromise sensitive data, bypass access controls, and potentially execute harmful code if vulnerable file types are uploaded and included by the attacker.

References