CVE-2025-53259
BaseFortify
Publication date: 2025-06-27
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Local File Inclusion (LFI) issue in the WordPress Hotel Booking plugin up to version 3.7. It allows an attacker with contributor-level privileges to include and display local files from the target website. These files may contain sensitive information such as database credentials, potentially leading to a complete database takeover depending on the website's configuration. [1]
How can this vulnerability impact me? :
If exploited, this vulnerability can allow an attacker to access sensitive files on your website, including database credentials. This could lead to a complete takeover of your database and compromise the confidentiality, integrity, and availability of your website and data. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
The provided resources do not include specific commands or methods to detect this vulnerability on your network or system. It is recommended to monitor for unusual file inclusion attempts or unauthorized access to local files, but no explicit detection commands are given.
What immediate steps should I take to mitigate this vulnerability?
Since no official patch is available, immediate mitigation can be done using virtual patching (vPatching) as suggested by Patchstack, which neutralizes the threat without impacting website performance. Additionally, restricting contributor-level privileges and monitoring for exploitation attempts are advisable. In case of compromise, professional incident response or server-side malware scanning is recommended over relying solely on plugin-based malware scanners. [1]