High severity · published Nov 5, 2025
CVE-2025-12497
Premium Portfolio Features for Phlox theme <= 2.3.10 - Unauthenticated Local File Inclusion via args[extra_template_path]
8.1
CVSS
0.6%
EPSS
No
On KEV
Description
The Premium Portfolio Features for Phlox theme plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.3.10 via the 'args[extra_template_path]' parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 50% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PP
Premium Portfolio Features for Phlox theme · averta
through 2.3.10 · source: vendor
Affected product
PP
Premium Portfolio Features for Phlox theme
averta
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-12497
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-12497
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset/3388727/auxin-portfolio
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/518abad2-d3cc-4d15-83d2-8fd99d30500c?source=cve
More from Premium Portfolio Features for Phlox theme
5.4
CVE-2024-1384
Premium Portfolio Features for Phlox theme <= 2.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
5.4
CVE-2024-3587
Premium Portfolio Features for Phlox theme <= 2.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via ' Grid Portfolios'