Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alex Prokopenko / JustCoded Just Post Preview Widget just-post-preview allows PHP Local File Inclusion.This issue affects Just Post Preview Widget: from n/a through <= 1.1.1.
Published: 2025-04-04
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability stems from improper control of a filename supplied to a PHP include/require statement, enabling local file inclusion. By manipulating the path parameter used by the Just Post Preview Widget plugin, an attacker can read arbitrary server files or execute code, potentially disclosing sensitive data or achieving full site compromise.

Affected Systems

WordPress installations that use the Just Post Preview Widget plug‑in produced by Alex Prokopenko / JustCoded, versions 1.1.1 and earlier are affected.

Risk and Exploitability

The CVSS score of 7.5 signals a high severity risk, but the EPSS score of less than 1% indicates that exploitation events are currently very rare. The vulnerability is not present in the CISA KEV catalog. The likely attack involves sending a crafted request to the plugin’s endpoint that accepts a filename parameter; the plugin then includes that file without path validation.

Generated by OpenCVE AI on May 1, 2026 at 00:40 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the latest available version of the Just Post Preview Widget plug‑in, which removes the insecure include path.
  • If an update is not yet available, disable the plug‑in entirely until the fix is released to prevent exploitation.
  • Restrict file system permissions on the plug‑in directory and other WordPress directories to read‑only for the web‑server process, minimizing the data that can be exposed through inclusion.
  • Deploy a web‑application firewall rule that blocks requests containing suspicious file‑path patterns (e.g., slashes or ".." sequences) directed at the plug‑in’s endpoints.

Generated by OpenCVE AI on May 1, 2026 at 00:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2025-9861 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alex Prokopenko / JustCoded Just Post Preview Widget allows PHP Local File Inclusion. This issue affects Just Post Preview Widget: from n/a through 1.1.1.
History

Thu, 23 Apr 2026 15:00:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Wed, 01 Apr 2026 23:45:00 +0000

Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alex Prokopenko / JustCoded Just Post Preview Widget allows PHP Local File Inclusion. This issue affects Just Post Preview Widget: from n/a through 1.1.1. Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alex Prokopenko / JustCoded Just Post Preview Widget just-post-preview allows PHP Local File Inclusion.This issue affects Just Post Preview Widget: from n/a through <= 1.1.1.
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Fri, 04 Apr 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 04 Apr 2025 16:15:00 +0000

Type Values Removed Values Added
Description Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Alex Prokopenko / JustCoded Just Post Preview Widget allows PHP Local File Inclusion. This issue affects Just Post Preview Widget: from n/a through 1.1.1.
Title WordPress Just Post Preview Widget plugin <= 1.1.1 - Local File Inclusion vulnerability
Weaknesses CWE-98
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: Patchstack

Published:

Updated: 2026-04-28T16:12:17.769Z

Reserved: 2025-04-04T10:00:58.028Z

Link: CVE-2025-32156

cve-icon Vulnrichment

Updated: 2025-04-04T19:53:17.946Z

cve-icon NVD

Status : Deferred

Published: 2025-04-04T16:15:24.147

Modified: 2026-04-23T15:28:39.793

Link: CVE-2025-32156

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-01T00:45:05Z

Weaknesses