CVE-2025-47496: WordPress PublishPress Authors plugin <= 4.7.5 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PublishPress PublishPress Authors allows PHP Local File Inclusion. This issue affects PublishPress Authors: from n/a through 4.7.5.
Other sources
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PublishPress PublishPress Authors publishpress-authors allows PHP Local File Inclusion.This issue affects PublishPress Authors: from n/a through <= 4.7.5.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47496?
CVE-2025-47496 is classified as a high severity vulnerability due to its potential for local file inclusion.
What kind of vulnerability is CVE-2025-47496?
CVE-2025-47496 is an Improper Control of Filename for Include/Require Statement vulnerability allowing local file inclusion in PublishPress Authors.
Which versions of PublishPress Authors are affected by CVE-2025-47496?
CVE-2025-47496 affects all versions of PublishPress Authors from n/a up to and including version 4.7.5.
How do I fix CVE-2025-47496?
To fix CVE-2025-47496, update PublishPress Authors to the latest version beyond 4.7.5.
Is there a workaround for CVE-2025-47496 if I cannot update?
Currently, there are no known effective workarounds for CVE-2025-47496 other than updating to a secure version.