CVE-2025-31387
CVSS 3.1 Score 7.5 of 10 (high)
Details
Published Mar 31, 2025
Updated: Apr 1, 2025
CWE ID 98
Summary
CVE-2025-31387 is a filename manipulation vulnerability affecting InstaWP Connect, a PHP application. The issue stems from the software's improper handling of include/require statements, enabling an attacker to include local files. This vulnerability, classified as a PHP Remote File Inclusion (RFI), can be exploited to gain unauthorized access to sensitive data or execute arbitrary code. InstaWP Connect versions from n/a through 0.1.0.82 are vulnerable to this issue.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- Connect Plugin