PT-2025-50808 · WordPress · Player Leaderboard

Kenneth Dunn · Published 2025-12-12 · Updated 2025-12-17 · CVE-2025-12824

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Player Leaderboard plugin for WordPress versions up to and including 1.0.2

Description The Player Leaderboard plugin for WordPress is susceptible to Local File Inclusion through the 'player leaderboard' shortcode. The issue stems from the plugin utilizing an unsanitized value from the 'mode' attribute within the shortcode in conjunction with the include() function, lacking adequate path validation. This allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary PHP files on the server. Successful exploitation could lead to bypassing access controls, obtaining sensitive data, or achieving full remote code execution, particularly if file upload functionality is also available. The vulnerable parameter is mode.

Recommendations Versions prior to 1.0.3 should be updated.

Fix

RCE

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2025-12824

Affected Products

Player Leaderboard

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-12824 · Security Note
• https://plugins.trac.wordpress.org/browser/player-leaderboard/trunk/public/class-player-leaderboard-public.php#L1419 · Note
• https://twitter.com/RedPacketSec/status/1999357682633916862 · Twitter Post
• https://twitter.com/cracbot/status/2001246036728386037 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3416129%40player-leaderboard&new=3416129%40player-leaderboard · Note
• https://twitter.com/CveFindCom/status/1999338431780938179 · Twitter Post
• https://t.me/cveNotify/145544 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/527f8f08-bab3-4319-99bf-845c8b378c19?source=cve · Note