CVE-2025-49264: 
WordPress vulnerability analysis and mitigation

CVE-2025-49264 is a Local File Inclusion vulnerability discovered in Cloud Infrastructure Services Cloud SAML SSO - Single Sign On Login plugin versions through 1.0.18. The vulnerability was disclosed on July 16, 2025, and is related to improper control of filename for Include/Require Statement in PHP Program (Patchstack).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) and requires no authentication to exploit (Patchstack).

This vulnerability could allow a malicious actor to include local files of the target website and display their contents. Particularly sensitive files containing credentials, such as database configuration files, could be exposed, potentially leading to complete database compromise depending on the system configuration (Patchstack).

The vulnerability has been fixed in version 1.0.19 of the Cloud SAML SSO - Single Sign On Login plugin. Users are strongly advised to update to this version or later immediately. Patchstack has issued a virtual patch to mitigate this issue by blocking attacks until users can update to the fixed version (Patchstack).

The vulnerability was initially reported by security researcher timomangcut on April 29, 2025. An early warning was sent to Patchstack customers on July 16, 2025, before the public disclosure on July 18, 2025 (Patchstack).