CVE-2025-11746: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in 8theme XStore
The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
AI Analysis
Technical Summary
CVE-2025-11746 is a path traversal vulnerability (CWE-22) in the XStore WordPress theme affecting all versions up to 9.5.4. The vulnerability exists in the theet_ajax_required_plugins_popup() function, allowing authenticated attackers with low privileges (Subscriber and above) to perform Local File Inclusion (LFI). This enables them to include arbitrary .php files on the server, potentially executing arbitrary PHP code. The vulnerability has a CVSS 3.1 score of 8.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official fix information is provided in the available data.
Potential Impact
Successful exploitation allows attackers with minimal privileges to execute arbitrary PHP code on the affected server. This can lead to bypassing access controls, unauthorized data access, and full system compromise. The high CVSS score (8.8) indicates significant risk to confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to prevent untrusted users from uploading PHP files, and consider disabling or restricting access to the vulnerable function if possible. Monitor for updates from 8theme regarding patches or official mitigations.
CVE-2025-11746: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in 8theme XStore
Description
The XStore theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 9.5.4 via theet_ajax_required_plugins_popup() function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2025-11746 is a path traversal vulnerability (CWE-22) in the XStore WordPress theme affecting all versions up to 9.5.4. The vulnerability exists in the theet_ajax_required_plugins_popup() function, allowing authenticated attackers with low privileges (Subscriber and above) to perform Local File Inclusion (LFI). This enables them to include arbitrary .php files on the server, potentially executing arbitrary PHP code. The vulnerability has a CVSS 3.1 score of 8.8, reflecting high impact on confidentiality, integrity, and availability. No patch or official fix information is provided in the available data.
Potential Impact
Successful exploitation allows attackers with minimal privileges to execute arbitrary PHP code on the affected server. This can lead to bypassing access controls, unauthorized data access, and full system compromise. The high CVSS score (8.8) indicates significant risk to confidentiality, integrity, and availability of the affected system.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user privileges to prevent untrusted users from uploading PHP files, and consider disabling or restricting access to the vulnerable function if possible. Monitor for updates from 8theme regarding patches or official mitigations.
Technical Details
- Data Version
- 5.1
- Assigner Short Name
- Wordfence
- Date Reserved
- 2025-10-14T14:23:56.888Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 68ef0c4955734f1608eb63a9
Added to database: 10/15/2025, 2:51:53 AM
Last enriched: 4/9/2026, 8:51:40 PM
Last updated: 5/10/2026, 8:39:12 AM
Views: 311
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.