{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-11704", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-13T19:10:53.316Z", "datePublished": "2025-11-04T04:27:20.117Z", "dateUpdated": "2026-04-08T17:11:30.173Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:11:30.173Z"}, "affected": [{"vendor": "impacttechlab", "product": "Elegance Menu", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Elegance Menu plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the 'elegance-menu' attribute of the `elegance-menu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "title": "Elegance Menu <= 1.9 - Authenticated (Contributor+) Local File Inclusion", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9cecce4d-5d4a-4286-97dc-88a379e21b60?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/elegance-menu/trunk/public/class-elegance-menu-public.php#L222"}, {"url": "https://wordpress.org/plugins/elegance-menu"}, {"url": "https://plugins.trac.wordpress.org/changeset/3409312/"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')", "cweId": "CWE-98", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "timeline": [{"time": "2025-11-03T15:34:04.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-04T15:51:46.461520Z", "id": "CVE-2025-11704", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T15:51:56.144Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-11704", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-11-04T15:51:46.461520Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-04T15:51:50.400Z"}}], "cna": {"title": "Elegance Menu <= 1.9 - Authenticated (Contributor+) Local File Inclusion", "credits": [{"lang": "en", "type": "finder", "value": "Djaidja Moundjid"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.5, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}}], "affected": [{"vendor": "impacttechlab", "product": "Elegance Menu", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "1.9"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-03T15:34:04.000+00:00", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9cecce4d-5d4a-4286-97dc-88a379e21b60?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/elegance-menu/trunk/public/class-elegance-menu-public.php#L222"}, {"url": "https://wordpress.org/plugins/elegance-menu"}], "descriptions": [{"lang": "en", "value": "The Elegance Menu plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the 'elegance-menu' attribute of the `elegance-menu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-98", "description": "CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-04T04:27:20.117Z"}}}, "cveMetadata": {"cveId": "CVE-2025-11704", "state": "PUBLISHED", "dateUpdated": "2025-11-04T15:51:56.144Z", "dateReserved": "2025-10-13T19:10:53.316Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-04T04:27:20.117Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The Elegance Menu plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the 'elegance-menu' attribute of the `elegance-menu` shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary .php files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included."}], "id": "CVE-2025-11704", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-11-04T05:15:53.957", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/elegance-menu/trunk/public/class-elegance-menu-public.php#L222"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3409312/"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/elegance-menu"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9cecce4d-5d4a-4286-97dc-88a379e21b60?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-98"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-22T12:56:06.415727+00:00", "value": {"mitigation_remediation": ["Upgrade the Elegance Menu plugin to a version newer than 1.9, if one is available, to patch the LFI flaw.", "If a patched version is not available, consider disabling or uninstalling the plugin from the WordPress installation until an update is released.", "Restrict Contributor users from using the 'elegance-menu' shortcode or uploading PHP files; reassign them to lower\u2011privilege roles such as Author, or apply a role\u2011based access control plugin to block this capability."], "summary": {"action": "Apply Patch", "impact": "Local File Inclusion enabling PHP code execution"}, "threat_synthesis": {"affected_systems": "ImpactTechLab\u2019s Elegance Menu plugin, any WordPress installation using versions 1.9 or earlier. No additional version details are provided beyond the latest vulnerable release, 1.9.", "description_and_impact": "The Elegance Menu plugin for WordPress contains a flaw in the handling of the 'elegance-menu' attribute of its shortcode. The bug, classified as CWE-98, allows an authenticated user with Contributor privilege or higher to cause the plugin to include arbitrary files present on the server. When a .php file is included, its contents are executed, effectively granting code execution on the WordPress installation. This can lead to privilege escalation, data theft, and full compromise of the site where the plugin is installed.", "risk_and_exploitability": "The CVSS score of 7.5 indicates a high severity risk. The EPSS score of less than 1% shows that, as of the data collection, exploitation activity is rare, and the vulnerability is not listed in the CISA KEV catalog. Nonetheless, the attack requires only Contributor-level access, which many sites grant to content editors, making the risk tangible. An attacker can upload a malicious PHP file and then trigger the LFI via the short\u2011code attribute, obtaining remote code execution on the web server."}}}}, "created": "2025-11-04T16:33:16.454594+00:00", "updated": "2026-04-22T13:00:09.743424+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}