CVE-2025-39592
CVSS 3.1 Score 7.5 of 10 (high)
Details
Published Apr 16, 2025
CWE ID 98
Summary
CVE-2025-39592 is a filename control vulnerability affecting WP Shuffle Subscribe to Unlock Lite, a WordPress plugin. The flaw, classified as a PHP Remote File Inclusion (RFI) vulnerability, enables an attacker to include local files on the affected system. This issue arises due to insufficient input validation for include/require statements in the plugin, allowing an attacker to manipulate filenames and execute arbitrary code. Affected versions range from n/a to 1.3.0. Immediate update to a secure version is recommended to mitigate this risk.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.