CVE-2025-67524: 
WordPress vulnerability analysis and mitigation

CVE-2025-67524 is a PHP Local File Inclusion (LFI) vulnerability in the NooTheme Jobmonster Elementor Addon WordPress plugin, affecting all versions up to and including 1.1.4. The flaw stems from improper control of filename parameters used in PHP include/require statements (CWE-98). It was reported by João Pedro S Alcântara (Kinorth) on November 12, 2025, and published on December 9–12, 2025. NVD assigns a CVSS v3.1 base score of 9.8 (Critical), while Patchstack rates it 7.5 with a low exploitation priority (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The plugin fails to properly sanitize or validate user-supplied input used in PHP include or require statements, allowing an attacker to manipulate the filename parameter to reference arbitrary local files on the server. Exploitation requires Contributor or Developer-level privileges according to Patchstack's detailed assessment, which contrasts with the NVD CVSS score indicating no privileges required — suggesting the attack surface may depend on specific plugin functionality or WordPress role context. The vulnerability maps to CAPEC-193 (PHP Remote File Inclusion) and OWASP Top 10 A1: Broken Access Control (Patchstack).

Successful exploitation allows an attacker to include and render arbitrary local files from the server, potentially exposing sensitive data such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to complete database compromise. Depending on server configuration and PHP settings, LFI may be chained with other techniques (e.g., log poisoning) to achieve remote code execution, resulting in full confidentiality, integrity, and availability impact. The vulnerability affects any WordPress site running the Jobmonster Elementor Addon plugin at version 1.1.4 or earlier (Patchstack).

As of the time of publication, there is no known public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Patchstack). The EPSS score is approximately 0.053%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack classifies the exploitation priority as low, noting it is unlikely to be exploited despite the critical CVSS score assigned by NVD.

1. Reconnaissance: Identify WordPress sites running the Jobmonster Elementor Addon plugin version ≤ 1.1.4 using tools like WPScan, Shodan, or Google dorks targeting plugin-specific paths.
2. Authenticate (if required): Obtain Contributor or Developer-level WordPress credentials, as Patchstack indicates some privilege may be required to access the vulnerable functionality.
3. Identify vulnerable parameter: Locate the plugin's Elementor widget or shortcode that accepts a filename or template parameter passed to a PHP include/require statement.
4. Craft LFI payload: Submit a manipulated filename parameter (e.g., ../../../../wp-config.php or /etc/passwd) via the vulnerable input field or HTTP request to traverse directories and include a target file.
5. Retrieve sensitive data: Observe the server response for the contents of the included file, extracting credentials or other sensitive information for further exploitation such as database access or privilege escalation (Patchstack).

• Network: HTTP requests to WordPress endpoints associated with the Jobmonster Elementor Addon containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields.
• Logs: WordPress or web server access logs showing requests with encoded directory traversal patterns targeting plugin-related URLs; repeated 200 responses to unusual file path parameters.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or PHP session files as reflected in server-side file access logs.
• Process: Unusual PHP process activity reading files outside the WordPress web root, particularly if LFI is chained with log poisoning for code execution.

The vulnerability is patched in Jobmonster Elementor Addon version 1.1.5; all site administrators should update immediately (Patchstack). Patchstack users can enable auto-update for vulnerable plugins to receive protection automatically. If an immediate update is not possible, consider temporarily disabling the plugin, restricting access to plugin functionality via role-based controls, and implementing a Web Application Firewall (WAF) rule to block path traversal patterns in requests.

Wordfence included CVE-2025-67524 in its weekly WordPress vulnerability report for December 8–14, 2025, highlighting it among notable plugin vulnerabilities of that period (Wordfence Blog). Taiwan's Ministry of Digital Affairs (MODA) also referenced the vulnerability in a security advisory report. No significant social media discussion or researcher commentary beyond standard vulnerability disclosure channels has been observed.