Introduction
Attackers can execute arbitrary PHP code on thousands of WordPress sites running the Premium Portfolio Features for Phlox theme plugin. The vulnerability, tracked as CVE-2025-12497, allows unauthenticated local file inclusion through a specific request parameter. That puts site integrity and sensitive data at risk.
The Premium Portfolio Features for Phlox theme plugin (also known as auxin-portfolio) has over 50000 active installations. It adds advanced portfolio management and display features, mainly for creative professionals who use the Phlox theme. With that many installs, a flaw in this plugin can affect a large share of the WordPress ecosystem.
Technical Information
CVE-2025-12497 is a local file inclusion (LFI) vulnerability in the Premium Portfolio Features for Phlox theme plugin for WordPress. It affects all versions up to and including 2.3.10. The plugin does not properly validate or sanitize the args[extra_template_path] parameter. When a request supplies this parameter, the plugin builds a file path from its value and passes that path to PHP's include or require functions without sufficient restriction.
An unauthenticated attacker can therefore send a request that sets args[extra_template_path] to a path of their choosing. The path can contain directory traversal sequences, or it can be an absolute path to a file already on the server. If the attacker can upload a PHP file to a writable directory (for example through a separate upload vulnerability or a misconfiguration), they can then include that file and execute arbitrary PHP code. Even without a file upload, the attacker may be able to include sensitive files like wp-config.php, which exposes database credentials and other secrets.
The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The root cause is missing validation on file paths before PHP includes them, a common and dangerous pattern in plugin development.
Affected Systems and Versions
- Product: Premium Portfolio Features for Phlox theme plugin (auxin-portfolio) for WordPress
- Affected versions: All versions up to and including 2.3.10
- Any WordPress site with this plugin at or below version 2.3.10 is vulnerable
Vendor Security History
The Premium Portfolio Features for Phlox theme plugin has a history of similar vulnerabilities:
- Earlier unauthenticated local file inclusion vulnerabilities were reported in versions up to 2.3.1 (CVE-2023-XXXXX, CVSS 9.8) and up to 2.3.10 (CVSS 8.6).
- Stored cross-site scripting (XSS) vulnerabilities have also affected the plugin, such as CVE-2024-1384 (affecting versions up to 2.3.3).
The repeated LFI and XSS reports point to persistent problems with input validation and secure coding in this plugin's development.
