Vulnerability DatabaseCVE-2025-47627

CVE-2025-47627:
WordPress vulnerability analysis and mitigation

Overview

The vulnerability (CVE-2025-47627) is an Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability affecting LCweb PrivateContent - Mail Actions plugin versions through 2.3.2. The vulnerability was discovered and disclosed on July 1, 2025 (Patchstack).

Technical details

The vulnerability is classified as a Local File Inclusion vulnerability with a CVSS v3.1 base score of 7.5 (High). The attack vector is Network-based (AV:N), with High attack complexity (AC:H), requiring No privileges (PR:N), and User interaction (UI:R). The scope is Unchanged (S:U) with High impacts on Confidentiality, Integrity, and Availability (C:H/I:H/A:H) (Patchstack).

Impact

This vulnerability could allow a malicious actor to include local files of the target website and display their contents. Particularly sensitive files containing credentials, such as database configurations, could potentially be exposed, leading to complete database compromise depending on the system configuration (Patchstack).

Mitigation and workarounds

Currently, there is no official fix available for this vulnerability. Patchstack has issued a virtual patch to mitigate the issue by blocking potential attacks until an official fix becomes available. Users are advised to implement the virtual patch immediately (Patchstack).