Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-2294
CVE-2025-2294:
WordPress vulnerability analysis and mitigation
Overview
The Kubio AI Page Builder plugin for WordPress contains a Local File Inclusion (LFI) vulnerability, tracked as CVE-2025-2294, affecting all versions up to and including 2.5.1. The vulnerability was discovered by security researcher mikemyers and affects over 90,000 active WordPress installations (Security Online, NVD).
Technical details
The vulnerability exists in the kubiohybridthemeloadtemplate function, allowing unauthenticated attackers to include and execute arbitrary files on the server. The severity is rated as Critical with a CVSS v3.1 score of 9.8 (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory) (NVD, Security Online).
Impact
The vulnerability enables attackers to bypass access controls, obtain sensitive data, and achieve code execution in cases where images and other "safe" file types can be uploaded and included. The widespread installation base of over 90,000 active sites amplifies the potential impact of this vulnerability (Security Online).
Mitigation and workarounds
The vulnerability has been patched in version 2.5.2 of the Kubio AI Page Builder plugin. Users are strongly advised to update to version 2.5.2 or later immediately to protect their websites from potential attacks (Security Online).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management