CVE-2025-23945: 
WordPress vulnerability analysis and mitigation

CVE-2025-23945 is a Local File Inclusion vulnerability discovered in the WordPress Popliup plugin affecting versions through 1.1.1. The vulnerability was disclosed on March 3, 2025, and is classified as a PHP Remote File Inclusion vulnerability, specifically related to Improper Control of Filename for Include/Require Statement in PHP Program (NVD, Patchstack).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. It is categorized under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The vulnerability requires subscriber-level privileges or higher to exploit (NVD, Patchstack).

This vulnerability could allow an attacker to include local files of the target website and display their contents. Particularly concerning is the potential access to files containing sensitive information such as database credentials, which could lead to a complete database compromise depending on the server configuration (Patchstack).

The vulnerability is considered highly dangerous and is expected to become mass exploited. It requires subscriber-level access or higher to exploit, making it an authenticated vulnerability (Patchstack).

Currently, no official fix is available for this vulnerability. Patchstack has issued a virtual patch to mitigate the issue by blocking potential attacks until an official fix becomes available. Users are advised to implement immediate mitigation measures (Patchstack).