CVE-2025-52814

The BRW plugin for WordPress (ova-brw) versions up to and including 1.8.7 suffer from a Local File Inclusion (LFI) vulnerability due to improper control of filenames for include and require statements [1]. This PHP LFI flaw enables an attacker to manipulate file paths to include arbitrary files from the local server.

Exploitation can be carried out remotely without authentication by crafting a malicious request that references a target file on the server [1]. The attack surface is broad, as the plugin is widely used, and the vulnerability is expected to be exploited in mass campaigns targeting thousands of websites.

Successful exploitation allows an attacker to read sensitive files, such as wp-config.php containing database credentials, potentially leading to complete database takeover or further compromise of the site [1].

The vulnerability is fixed in version 1.8.8 of the plugin. Users are strongly advised to update immediately. Patchstack also provides a mitigation rule for users unable to update promptly [1].