CVE-2025-12851

Name of the Vulnerable Software and Affected Versions My auctions allegro plugin for WordPress versions through 3.6.32

Description The My auctions allegro plugin for WordPress is susceptible to a Local File Inclusion issue via the controller parameter. This allows unauthenticated attackers to include and execute arbitrary files on the server, potentially enabling the execution of PHP code within those files. Successful exploitation could bypass access controls and allow the retrieval of sensitive data or code execution, particularly if attackers can upload and include files.

Recommendations Update the My auctions allegro plugin for WordPress to a version later than 3.6.32.