CVE-2025-10686
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-14

Last updated on: 2025-11-14

Assigner: WPScan

Description
The Creta Testimonial Showcase WordPress plugin before 1.2.4 is vulnerable to Local File Inclusion. This makes it possible for authenticated attackers, with editor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-14
Last Modified
2025-11-14
Generated
2026-06-16
AI Q&A
2025-11-14
EPSS Evaluated
2026-06-15
NVD
CVE-2025-10686
EUVD
EUVD-2025-186559
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
creta testimonial_showcase 1.2.4
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability is a Local File Inclusion (LFI) issue in the Creta Testimonial Showcase WordPress plugin versions before 1.2.4. It allows authenticated users with editor-level access or higher to include and execute arbitrary files on the server, which means they can run any PHP code contained in those files.

Impact Analysis

The vulnerability can allow attackers with sufficient privileges to execute arbitrary PHP code on the server. This can lead to unauthorized actions such as data theft, server compromise, or further exploitation of the system.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-10686. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart