CVE-2025-52728
BaseFortify
Publication date: 2025-08-14
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| webcodingplace | responsive_posts_carousel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an improper control of the filename used in include or require statements in the PHP code of the Responsive Posts Carousel WordPress Plugin. It allows a PHP Local File Inclusion attack, meaning an attacker can trick the plugin into including and executing local files on the server, potentially leading to unauthorized code execution or information disclosure.
How can this vulnerability impact me? :
This vulnerability can lead to serious impacts including unauthorized disclosure of sensitive information, execution of arbitrary code, and potential full compromise of the affected server. It can affect the confidentiality, integrity, and availability of the system where the vulnerable plugin is installed.