PT-2025-49897 · Unknown · Select Core

Published 2025-12-09 · Updated 2025-12-15 · CVE-2025-67521

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Select Core versions prior to 2.6

Description An improper control of filename for include/require statement exists in Select Core, potentially allowing for PHP Local File Inclusion. This issue is related to PHP Remote File Inclusion.

Recommendations Update Select Core to version 2.6 or later.

Fix

Weakness Enumeration

CWE-98

Related Identifiers

CVE-2025-67521

Affected Products

Select Core

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-67521 · Security Note
• https://patchstack.com/database/Wordpress/Plugin/select-core/vulnerability/wordpress-select-core-plugin-2-6-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://vdp.patchstack.com/database/Wordpress/Plugin/select-core/vulnerability/wordpress-select-core-plugin-2-6-local-file-inclusion-vulnerability?_s_id=cve · Note
• https://twitter.com/CVEnew/status/2000617572757094512 · Twitter Post