CVE-2025-54017: WordPress Paid Member Subscriptions <= 2.15.4 - Local File Inclusion Vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cozmoslabs Paid Member Subscriptions allows PHP Local File Inclusion. This issue affects Paid Member Subscriptions: from n/a through 2.15.4.
Other sources
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows PHP Local File Inclusion.This issue affects Paid Member Subscriptions: from n/a through <= 2.15.4.
— MITRE
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54017?
CVE-2025-54017 is rated as a critical severity vulnerability due to its potential for local file inclusion attacks.
How do I fix CVE-2025-54017?
To fix CVE-2025-54017, update the Paid Member Subscriptions plugin to version 2.15.5 or later immediately.
What does CVE-2025-54017 affect?
CVE-2025-54017 affects versions of the Cozmoslabs Paid Member Subscriptions plugin up to and including 2.15.4.
Can CVE-2025-54017 be exploited remotely?
CVE-2025-54017 can potentially be exploited remotely due to the nature of local file inclusion vulnerabilities.
What are the consequences of CVE-2025-54017 exploitation?
Exploitation of CVE-2025-54017 can lead to unauthorized access to sensitive files on the server.