CVE-2025-11704 is a Local File Inclusion vulnerability classified under CWE-98 affecting the Elegance Menu plugin for WordPress, developed by impacttechlab. The vulnerability exists in all versions up to and including 1.9 and is triggered via the 'elegance-menu' attribute of the plugin's shortcode. An attacker with authenticated access at the Contributor level or above can manipulate this attribute to include arbitrary PHP files from the server filesystem. This inclusion leads to execution of arbitrary PHP code, which can be leveraged to bypass access controls, extract sensitive information, or execute malicious code remotely. The vulnerability requires network access and low privilege authentication but does not require user interaction. The CVSS v3.1 score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with an attack vector over the network, high attack complexity, and low privileges required. No patches or known exploits are currently reported, but the vulnerability poses a significant risk to WordPress sites using this plugin, especially those that allow Contributor-level access to untrusted users or permit uploading PHP files. The flaw stems from improper control of filenames used in include/require statements, allowing attackers to specify arbitrary files for inclusion.

The impact of CVE-2025-11704 is substantial for organizations running WordPress sites with the Elegance Menu plugin. Successful exploitation can lead to remote code execution, enabling attackers to fully compromise the affected web server. This can result in unauthorized access to sensitive data, website defacement, deployment of malware or ransomware, and lateral movement within the hosting environment. Since Contributor-level access is sufficient, insider threats or compromised lower-privileged accounts can escalate their privileges significantly. The vulnerability undermines the integrity and availability of the website and potentially the entire hosting infrastructure. Organizations relying on WordPress for business-critical applications or e-commerce are at heightened risk of operational disruption and reputational damage. The lack of known exploits in the wild currently provides a window for proactive mitigation, but the high severity score indicates urgent attention is required.

1. Immediately audit and restrict Contributor-level and higher access to trusted users only, minimizing the risk of exploitation from low-privileged accounts. 2. Disable or remove the Elegance Menu plugin until a security patch or update is released by impacttechlab. 3. Monitor web server logs and WordPress shortcode usage for suspicious activity related to the 'elegance-menu' attribute or unusual file inclusion attempts. 4. Implement strict file upload controls to prevent uploading of PHP files or other executable code by users, including sanitizing and validating all uploads. 5. Employ Web Application Firewalls (WAFs) with rules designed to detect and block Local File Inclusion attempts targeting the plugin. 6. Regularly update WordPress core, plugins, and themes to the latest versions to reduce exposure to known vulnerabilities. 7. Conduct security awareness training for site administrators and contributors about the risks of privilege misuse and plugin vulnerabilities. 8. Once a patch is available, apply it promptly and verify the fix through testing in a staging environment before production deployment.