CVE-2025-28979

WordPress WP Pipes <= 1.4.3 - Local File Inclusion Vulnerability

View on CVE.org
Published Aug 14, 2025 CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local File Inclusion. This issue affects WP Pipes: from n/a through 1.4.3.

Analysis

AI-generated

Technical impact

The flaw is improperly controlling the filename used in an include/require statement, which can allow untrusted input to point to arbitrary local files. An attacker who can influence the include path may read or execute code from the server, leading to compromised confidentiality, integrity, or availability. This is a classic PHP LFI that can be escalated to remote code execution via crafted local files.

Affected Systems

The vulnerable plugin is ThimPress WP Pipes, versions up to and including 1.4.3, deployed on WordPress installations. The plugin is distributed for WordPress, and any site using WP Pipes prior to 1.4.3 is affected.

Risk and Exploitability

The CVSS score is 8.1, indicating high severity. The EPSS score is less than 1%, so exploitation likelihood is low but non-zero. The vulnerability is not listed in CISA KEV. Attackers would need to supply a crafted request to the plugin’s include parameter, which is presumably accessible via a public URL. If the plugin is exposed to the Internet, the LFI can be exploited remotely.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade WP Pipes to a version newer than 1.4.3.
  • If an upgrade is delayed, disable the WP Pipes plugin until a fix is applied.
  • Verify that any file inclusion parameters are properly sanitized and that disallowed file paths cannot be requested.
  • If possible, restrict access to the administrative endpoints of the plugin using firewall rules.

Generated by OpenCVE AI on May 1, 2026 at 06:43 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2025-24733 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local File Inclusion. This issue affects WP Pipes: from n/a through 1.4.3.
History
Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes wp-pipes allows PHP Local File Inclusion.This issue affects WP Pipes: from n/a through <= 1.4.3. Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local File Inclusion. This issue affects WP Pipes: from n/a through 1.4.3.
References
Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local File Inclusion. This issue affects WP Pipes: from n/a through 1.4.3. Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes wp-pipes allows PHP Local File Inclusion.This issue affects WP Pipes: from n/a through <= 1.4.3.
References
Type Values Removed Values Added
CPEs cpe:2.3:a:thimpress:wp_pipes:*:*:*:*:*:wordpress:*:*
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Thimpress
Thimpress wp Pipes
Wordpress
Wordpress wordpress
Vendors & Products Thimpress
Thimpress wp Pipes
Wordpress
Wordpress wordpress
Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local File Inclusion. This issue affects WP Pipes: from n/a through 1.4.3.
Title WordPress WP Pipes <= 1.4.3 - Local File Inclusion Vulnerability
Weaknesses CWE-98
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}
Earlier changes (3)
Weaknesses
  • CWE-98

    Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

Sources

Status
PUBLISHED
Assigner
Patchstack
Published
Updated
Apr 28, 2026, 4:11 PM
Reserved
Mar 11, 2025, 8:10 AM

View source JSON

Updated
Aug 14, 2025, 7:46 PM

JSON

Status
Modified
Published
Aug 14, 2025, 11:15 AM
Modified
Jun 17, 2026, 9:04 AM

View source JSON

No data.

Updated
May 1, 2026, 6:45 AM

JSON