CVE-2025-49307: 
WordPress vulnerability analysis and mitigation

CVE-2025-49307 is a Local File Inclusion vulnerability discovered in the Magazine3 WP Multilang WordPress plugin affecting versions through 2.4.19. The vulnerability was discovered by researcher muhammad yudha and was publicly disclosed on June 5, 2025 (Patchstack).

The vulnerability is classified as an Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability (CWE-98). It has received a CVSS v3.1 Base Score of 7.5 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

This vulnerability could allow a malicious actor to include local files of the target website and display their contents. Particularly sensitive files containing credentials, such as database configuration files, could potentially be exposed, leading to complete database compromise depending on the system configuration (Patchstack).

The vulnerability requires contributor-level privileges to exploit, and while rated as HIGH severity, it has been categorized as having a low priority for patching due to the complexity of exploitation (Patchstack).

The vulnerability has been patched in version 2.4.19.1 of the WP Multilang plugin. Users are advised to update to this version or later to remediate the security issue (Patchstack).