PT-2025-45104 · WordPress · Premium Portfolio Features For Phlox

Liontree · Published 2025-11-05 · Updated 2025-11-10 · CVE-2025-12497

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Premium Portfolio Features for Phlox theme plugin for WordPress versions prior to 2.3.11

Description The Premium Portfolio Features for Phlox theme plugin for WordPress is susceptible to Local File Inclusion in versions prior to 2.3.11. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, potentially enabling them to bypass access controls, obtain sensitive data, or achieve code execution if .php file uploads are permitted. The issue is triggered through the args[extra template path] parameter.

Recommendations Update the Premium Portfolio Features for Phlox theme plugin for WordPress to version 2.3.11 or later. As a temporary workaround, restrict access to the args[extra template path] parameter.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-12497

Affected Products

Premium Portfolio Features For Phlox

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-12497 · Security Note
• https://twitter.com/cracbot/status/1987837701534757119 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3388727/auxin-portfolio · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/518abad2-d3cc-4d15-83d2-8fd99d30500c?source=cve · Note
• https://t.me/cveNotify/141790 · Telegram Post
• https://t.me/CVEtracker/36612 · Telegram Post