CVE-2025-69375: 
WordPress vulnerability analysis and mitigation

CVE-2025-69375 is a PHP Local File Inclusion (LFI) vulnerability in the SolverWp Portfolio Builder WordPress plugin (swp-portfolio), affecting all versions through 1.2.5. The flaw stems from improper control of filenames used in PHP include/require statements (CWE-98). It was reported by researcher Phat RiO on November 22, 2025, and published by Patchstack on February 5, 2026, with NVD publication on February 20, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which enables PHP Local File Inclusion. The plugin fails to properly sanitize or validate user-supplied input used in PHP include or require statements, allowing an unauthenticated remote attacker to manipulate the filename parameter and force the server to include arbitrary local files. No authentication or user interaction is required, though the attack complexity is rated High, suggesting some precondition (such as a specific server configuration or path traversal constraint) must be met. No public proof-of-concept code has been identified (Patchstack).

Successful exploitation allows an attacker to include and render arbitrary local files from the server, potentially exposing sensitive data such as WordPress configuration files (wp-config.php) containing database credentials, which could lead to full database compromise. Depending on server configuration, LFI may be chained with file upload functionality or log poisoning to achieve remote code execution, resulting in complete confidentiality, integrity, and availability compromise of the affected WordPress site. The network-based attack vector means exploitation can occur remotely without any user interaction (Patchstack).

As of the time of reporting, no public proof-of-concept exploit code exists and no in-the-wild exploitation has been observed. The EPSS score is approximately 0.053% (0.000530), indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Patchstack notes that vulnerabilities of this CVSS severity class are frequently targeted in mass-exploit campaigns against WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Portfolio Builder plugin (swp-portfolio) version 1.2.5 or earlier using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/plugins/swp-portfolio).
2. Identify vulnerable parameter: Analyze the plugin's PHP source code or HTTP requests to locate the endpoint and parameter that passes user input to a PHP include or require statement without proper sanitization.
3. Craft LFI payload: Construct a request with a path traversal payload (e.g., ../../../../wp-config.php or ../../../../etc/passwd) in the vulnerable parameter to reference a sensitive local file.
4. Send malicious request: Submit the crafted HTTP request to the vulnerable WordPress endpoint (unauthenticated), causing the server to include and output the contents of the targeted local file.
5. Escalate (optional): If the server logs PHP errors or access logs are web-accessible, inject PHP code into logs and include the log file via LFI to achieve remote code execution (Patchstack).

• Network: Unusual HTTP GET or POST requests to plugin endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in parameters associated with the swp-portfolio plugin.
• Logs: WordPress or web server access logs showing requests to wp-content/plugins/swp-portfolio/ with encoded or raw path traversal strings; PHP warning/error log entries referencing unexpected file paths being included.
• File System: Unexpected PHP files or web shells written to the WordPress uploads directory or plugin directory; modification timestamps on core files (e.g., wp-config.php) that do not align with legitimate updates.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) if LFI has been escalated to RCE via log poisoning or file upload chaining.

No official patch from the plugin developer (SolverWp) was available as of the publication date; the vulnerable version remains 1.2.5 and below. Site administrators should immediately deactivate and remove the Portfolio Builder plugin until a patched version is released. Patchstack has issued a virtual patch (mitigation rule) for Patchstack-protected sites to block exploitation attempts in the interim. Additionally, implement web application firewall (WAF) rules to block path traversal patterns targeting the plugin's endpoints, and restrict PHP file inclusion via open_basedir server configuration (Patchstack).

Patchstack credited researcher Phat RiO with discovering and responsibly reporting the vulnerability on November 22, 2025. Wordfence referenced the vulnerability in their weekly WordPress vulnerability report for the week of February 2–8, 2026, indicating broader community awareness within the WordPress security ecosystem. No significant vendor statement from SolverWp or widespread social media discussion has been identified (Patchstack).