CVE-2025-2294

The vulnerability present in the Kubio AI Page Builder plugin for WordPress is characterized by a Local File Inclusion (LFI) flaw, which allows an attacker to manipulate file paths and include arbitrary files from the server. This vulnerability arises from improper validation of user input in the function responsible for loading templates. Specifically, the function does not adequately sanitize or restrict the file paths that can be included, leading to the potential for unauthorized access to sensitive files. Attackers can exploit this weakness to execute PHP code embedded in files that they can upload or access, thereby gaining control over the server environment.

Exploitation of this vulnerability can occur through various attack vectors. An unauthenticated attacker could craft a request that targets the vulnerable function, manipulating the input parameters to include files located on the server. For instance, if the attacker can upload a file containing malicious PHP code, they could then use the LFI vulnerability to execute that code by including the uploaded file. This scenario is particularly concerning because it allows attackers to bypass traditional access controls, as they do not need to authenticate to exploit the vulnerability. Additionally, the ability to include files can lead to further attacks, such as remote code execution, data exfiltration, or even full server compromise.

The real-world impact of this vulnerability can be substantial, particularly for organizations that rely on the affected plugin for their WordPress sites. The high CVSS score of 9.8 indicates a critical risk level, suggesting that successful exploitation could lead to severe consequences, including unauthorized access to sensitive data, defacement of websites, or the installation of backdoors for persistent access. Businesses may face reputational damage, loss of customer trust, and potential legal ramifications if sensitive information is compromised. Furthermore, the operational impact could result in downtime and the costs associated with incident response and recovery efforts.

To detect and mitigate the risks associated with this vulnerability, organizations should implement a multi-faceted approach. Regular security assessments, including vulnerability scanning and penetration testing, can help identify and remediate such flaws before they can be exploited. Additionally, maintaining an up-to-date inventory of plugins and themes, along with prompt application of security patches, is crucial. Organizations should also consider employing web application firewalls (WAFs) to filter and monitor HTTP requests, blocking those that exhibit malicious patterns indicative of LFI attempts. Furthermore, implementing strict file upload controls and input validation can significantly reduce the attack surface, making it more difficult for attackers to leverage this vulnerability.

In conclusion, the Local File Inclusion vulnerability in the Kubio AI Page Builder plugin poses a significant threat to WordPress installations. The potential for unauthorized file execution and access to sensitive data underscores the importance of proactive security measures. By understanding the technical details of the vulnerability, recognizing the various exploitation scenarios, and implementing effective detection and mitigation strategies, organizations can better protect themselves against this and similar threats in the ever-evolving landscape of cybersecurity.

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting the Local File Inclusion vulnerability in the Kubio AI Page Builder plugin. This surge is accompanied by a significant increase in the Exploit Prediction Scoring System (EPSS) score, now placing the vulnerability in the 99th percentile for likelihood of exploitation. The emergence of multiple new proof-of-concept exploits across public repositories further amplifies the risk, indicating growing attacker interest and lowering the barrier for adversaries to weaponize this flaw. For defenders, this heightened activity signals an urgent need to prioritize monitoring and detection efforts around this vulnerability, as the probability of active exploitation campaigns has substantially increased. Consequently, the threat level associated with CVE-2025-2294 has escalated from critical to an even more imminent and actionable risk, underscoring its prominence in the current exploit landscape.

Update 2 — July 04, 2026

CSURFACE threat intelligence has identified a discernible uptick in exploitation attempts targeting CVE-2025-2294, reflecting a marked escalation in adversary activity. While the EPSS score shows a slight decline, our telemetry reveals an increased frequency of triggers associated with this vulnerability, indicating sustained attacker interest despite minor fluctuations in predictive scoring. The emergence of additional proof-of-concept exploits across multiple public repositories continues to lower the technical barrier for exploitation, facilitating broader adversary engagement. This evolving landscape underscores a heightened operational tempo among threat actors aiming to leverage the Local File Inclusion flaw in the Kubio AI Page Builder plugin. For defenders, this development signifies an elevated risk environment where opportunistic and targeted attacks are more probable, necessitating intensified vigilance. Consequently, the threat level for CVE-2025-2294 remains critically high, with an increased likelihood of active exploitation campaigns that could lead to unauthorized code execution and data compromise.

Update 3 — July 12, 2026

CSURFACE threat intelligence has detected a marked escalation in exploitation attempts targeting the Kubio AI Page Builder vulnerability, with telemetry indicating a significant uptick in adversary engagement. This surge is accompanied by the emergence of additional proof-of-concept exploits circulating publicly, which lowers the barrier for less sophisticated threat actors to weaponize the Local File Inclusion flaw. Although the EPSS score remains high, the slight downward trend suggests some stabilization; however, the overall operational tempo among attackers has intensified. For defenders, this evolving threat landscape signals an increased likelihood of opportunistic and targeted attacks leveraging unauthenticated code execution, heightening the risk of unauthorized access and data compromise. Consequently, the threat level for CVE-2025-2294 is reaffirmed as critically high, underscoring the need for sustained vigilance amid expanding exploitation activity.