CVE-2025-9993 is a Local File Inclusion vulnerability (CWE-98) in the Bei Fen – WordPress Backup Plugin for WordPress, affecting all versions up to 1.4.2. The flaw allows authenticated attackers with Subscriber-level privileges or higher to manipulate the 'task' parameter to include and execute arbitrary PHP files on the server. This vulnerability only impacts environments running PHP 7.1 or older. Exploitation can result in code execution, access control bypass, and data disclosure. The CVSS 3.1 base score is 8.1, indicating high severity. There is no known patch or official vendor advisory at this time.

Successful exploitation enables attackers with low-level authenticated access to execute arbitrary PHP code on the affected server, potentially leading to full compromise of the WordPress site, bypass of access controls, and exposure of sensitive data. The impact is significant on systems running PHP 7.1 or older. No known exploits are reported in the wild yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict Subscriber-level user capabilities if possible and upgrade PHP to a version newer than 7.1, as the vulnerability only affects PHP 7.1 or older. Monitor for updates from the plugin vendor and apply patches promptly once released.