CVE-2025-13886: 
WordPress vulnerability analysis and mitigation

CVE-2025-13886 is a Local File Inclusion (LFI) vulnerability in the LT Unleashed plugin for WordPress, affecting all versions up to and including 1.1.1. The flaw exists in the book shortcode's template parameter due to insufficient path sanitization, allowing authenticated attackers with Contributor-level access or above to include and execute arbitrary PHP files on the server. It was disclosed on December 11–12, 2025, with Wordfence as the reporting CNA. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Wordfence, ENISA EUVD).

The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The template parameter passed to the book shortcode is not properly sanitized before being used in a PHP file inclusion operation, enabling path traversal to arbitrary server-side files. An attacker with at least Contributor-level WordPress access can craft a shortcode invocation that causes the server to include and execute any PHP file accessible to the web server process — including sensitive files like wp-config.php. The vulnerable code is visible in the plugin source at line 315 of lt-unleashed.php (Wordfence, Plugin Source).

Successful exploitation allows an authenticated attacker to read sensitive configuration files (e.g., wp-config.php, which contains database credentials), execute arbitrary PHP code on the server, and potentially achieve full site compromise. The confidentiality, integrity, and availability of the affected WordPress installation are all rated as High impact. In environments where the web server has broad filesystem access, this vulnerability could facilitate lateral movement or privilege escalation beyond the WordPress application itself (Wordfence, ENISA EUVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.093%, indicating a low current probability of exploitation in the wild. The vulnerability requires authenticated access at the Contributor level or above, which raises the exploitation bar compared to unauthenticated flaws. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability has been detected by Qualys scanners (detection ID 530749) (Wordfence, Feedly).

1. Reconnaissance: Identify WordPress sites running the LT Unleashed plugin version ≤ 1.1.1 using tools like WPScan or by checking the plugin's readme.txt file exposed at /wp-content/plugins/lt-unleashed/readme.txt.
2. Obtain Contributor Access: Register or compromise a WordPress account with at least Contributor-level privileges (e.g., via credential stuffing, phishing, or exploiting open registration).
3. Craft Malicious Shortcode: In a post or page draft, insert a [book] shortcode with the template parameter set to a path-traversal string targeting a sensitive file, e.g., [book template="../../../../wp-config.php"].
4. Trigger File Inclusion: Preview or publish the post to cause the server to include and execute the targeted PHP file, exposing its contents or executing embedded PHP code.
5. Exfiltrate Data or Execute Code: Retrieve database credentials from wp-config.php output, or if a previously uploaded file with PHP code exists on the server, include it to achieve remote code execution and establish persistence (Wordfence, Plugin Source).

• Logs: WordPress access logs showing POST or GET requests to pages/posts containing [book template= shortcode with path traversal sequences (e.g., ../, ..%2F); PHP error logs referencing unexpected file inclusion paths from lt-unleashed.php.
• File System: Unexpected new PHP files in the WordPress uploads directory or plugin directories that could be used as included payloads; modification timestamps on wp-config.php or other core files.
• Process: Unusual child processes spawned by the PHP/web server process (e.g., curl, wget, reverse shell connections) following shortcode rendering.
• Network: Outbound connections from the web server to unknown external IPs shortly after shortcode execution, potentially indicating a reverse shell or data exfiltration attempt.

WordPress site administrators should update the LT Unleashed plugin to a version above 1.1.1 that includes proper path sanitization for the template parameter. If an updated version is not yet available, the plugin should be deactivated and removed until a patch is released. As an additional hardening measure, restrict WordPress user registration and limit Contributor-level account creation to trusted users only. Web application firewalls (WAFs) with rules targeting path traversal patterns can provide a compensating control (Wordfence, Wordfence Weekly Report).

Wordfence reported the vulnerability in their weekly WordPress vulnerability report for December 8–14, 2025, and published a threat intelligence entry with full details. RedPacket Security and several automated CVE tracking accounts on social platforms (Bluesky, X/Twitter) flagged the CVE shortly after disclosure. No significant independent researcher commentary or major media coverage has been identified beyond standard vulnerability aggregation (Wordfence Weekly Report, RedPacket Security).