PT-2025-49233 · WordPress · My Auctions Allegro Plugin For Wordpress

Published 2025-12-05 · Updated 2025-12-10 · CVE-2025-12851

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions My auctions allegro plugin for WordPress versions through 3.6.32

Description The My auctions allegro plugin for WordPress is susceptible to a Local File Inclusion issue via the controller parameter. This allows unauthenticated attackers to include and execute arbitrary files on the server, potentially enabling the execution of PHP code within those files. Successful exploitation could bypass access controls and allow the retrieval of sensitive data or code execution, particularly if attackers can upload and include files.

Recommendations Update the My auctions allegro plugin for WordPress to a version later than 3.6.32.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-12851

Affected Products

My Auctions Allegro Plugin For Wordpress

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-12851 · Security Note
• https://t.me/cveNotify/144850 · Telegram Post
• https://t.me/CVEtracker/38915 · Telegram Post
• https://plugins.trac.wordpress.org/changeset/3402268/my-auctions-allegro-free-edition · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/202a8493-6df0-4a5e-b6bf-099219830e01?source=cve · Note
• https://twitter.com/VulmonFeeds/status/1996999772071149930 · Twitter Post
• https://twitter.com/cracbot/status/1998709329273454848 · Twitter Post
• https://twitter.com/CVEnew/status/1996893847016657014 · Twitter Post