CVE-2025-12497

Name of the Vulnerable Software and Affected Versions Premium Portfolio Features for Phlox theme plugin for WordPress versions prior to 2.3.11

Description The Premium Portfolio Features for Phlox theme plugin for WordPress is susceptible to Local File Inclusion in versions prior to 2.3.11. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, potentially enabling them to bypass access controls, obtain sensitive data, or achieve code execution if .php file uploads are permitted. The issue is triggered through the args[extra template path] parameter.

Recommendations Update the Premium Portfolio Features for Phlox theme plugin for WordPress to version 2.3.11 or later. As a temporary workaround, restrict access to the args[extra template path] parameter.