CVE-2025-10686
Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-14

Last updated on: 2025-11-14

Assigner: WPScan

Description
The Creta Testimonial Showcase WordPress plugin before 1.2.4 is vulnerable to Local File Inclusion. This makes it possible for authenticated attackers, with editor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2025-11-14
Last Modified
2025-11-14
Generated
2026-07-06
AI Q&A
2025-11-14
EPSS Evaluated
2026-07-05
NVD
CVE-2025-10686
EUVD
EUVD-2025-186559

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
creta testimonial_showcase 1.2.4

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Local File Inclusion (LFI) issue in the Creta Testimonial Showcase WordPress plugin versions before 1.2.4. It allows authenticated users with editor-level access or higher to include and execute arbitrary files on the server, which means they can run any PHP code contained in those files.

Impact Analysis

The vulnerability can allow attackers with sufficient privileges to execute arbitrary PHP code on the server. This can lead to unauthorized actions such as data theft, server compromise, or further exploitation of the system.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-10686. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart