CVE-2025-48293: WordPress Geo Mashup plugin <= 1.13.16 - Local File Inclusion vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dylan Kuhn Geo Mashup allows PHP Local File Inclusion. This issue affects Geo Mashup: from n/a through 1.13.16.
Other sources
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows PHP Local File Inclusion.This issue affects Geo Mashup: from n/a through <= 1.13.16.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-48293?
CVE-2025-48293 is a high-severity vulnerability due to its potential for PHP Local File Inclusion, which can allow unauthorized access to sensitive files.
How do I fix CVE-2025-48293?
To fix CVE-2025-48293, update the Geo Mashup plugin to the latest version beyond 1.13.16 or apply any provided patches from the vendor.
What are the potential impacts of CVE-2025-48293?
The impacts of CVE-2025-48293 include unauthorized file access and the potential for remote code execution if exploited.
What versions of Geo Mashup are affected by CVE-2025-48293?
CVE-2025-48293 affects Geo Mashup versions from n/a through 1.13.16.
Is this vulnerability specific to WordPress installations?
Yes, CVE-2025-48293 specifically affects the WordPress Geo Mashup plugin in addition to the standalone Geo Mashup software.