CVE-2025-2294: Unauthenticated Local File Inclusion in Kubio AI Page Builder

Introduction

CVE-2025-2294 is a critical vulnerability affecting the Kubio AI Page Builder WordPress plugin. The vulnerability is a Local File Inclusion (LFI) issue that can be triggered without authentication.

The issue affects Kubio AI Page Builder versions 2.5.1 and earlier and is classified as CWE-22: Improper Limitation of a Pathname to a Restricted Directory (Path Traversal). The vulnerability received a CVSS v3.1 score of 9.8 (Critical).

A public proof-of-concept repository is also available from Yucaerin/CVE-2025-2294, making the vulnerability relevant for security researchers and WordPress administrators. The repository contains a Python-based research script and identifies the affected Kubio AI Page Builder versions as <= 2.5.1.

Vulnerability Overview

The vulnerable functionality is associated with the kubio_hybrid_theme_load_template function.

According to the CVE record, the function can be abused to perform Local File Inclusion, allowing an unauthenticated attacker to cause the application to load files from locations that should not normally be accessible through the intended application flow.

In simplified terms, the security problem looks like this:

Unauthenticated request
        │
        ▼
Theme template loading
        │
        ▼
User-controlled file/path
        │
        ├── Intended path validation
        ├── Restricted directory check
        └── File inclusion
               │
               ▼
        Insufficient restriction
               │
               ▼
        Local File Inclusion

The important point is that a file-loading function should never blindly trust a path or filename supplied through an HTTP request.

The application should ensure that the requested resource remains inside an explicitly permitted directory and that path traversal techniques cannot escape that boundary.

Why Is This Vulnerability Serious?

Local File Inclusion vulnerabilities can be dangerous because the affected application may gain access to files outside the intended application context.

In the case of CVE-2025-2294, the vulnerability is particularly serious because the vulnerable functionality does not require authentication. The CVE description states that arbitrary files can potentially be included and that PHP code contained in those files may be executed under certain circumstances.

The potential consequences include:

• Access to sensitive local files
• Bypassing application-level access controls
• Exposure of configuration information
• Execution of PHP code in applicable scenarios
• Further compromise of the affected WordPress installation

The CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

This represents a vulnerability that is remotely reachable, has low attack complexity, requires no privileges or user interaction, and can potentially have high impact across confidentiality, integrity, and availability.

Root Cause

The underlying issue is an improper limitation of file paths used by the application's template-loading mechanism.

A secure file inclusion implementation should independently validate at least:

• The requested filename
• The canonicalized file path
• The allowed base directory
• Whether the resolved path remains inside that directory
• Path traversal sequences and their encoded variants
• Symbolic-link behavior where relevant
• The type of resource that can be loaded
• Whether the requested file should be accessible at all

A safer design is conceptually:

Requested path
      │
      ▼
Canonicalize path
      │
      ▼
Resolve against allowed base directory
      │
      ▼
Check resulting path
      │
      ├── Inside allowed directory → Continue
      │
      └── Outside allowed directory → Reject

CVE-2025-2294 demonstrates why simply concatenating a user-controlled value with a trusted directory is not sufficient for secure file handling.

Affected Versions

The vulnerable versions are:

The vulnerability was publicly disclosed in March 2025. Wordfence and other vulnerability databases identify 2.5.2 as the patched version.

Public PoC

The GitHub repository associated with this research contains a Python-based proof-of-concept script named CVE-2025-2294.py. The repository also includes a README and an image demonstrating the research.

The repository lists:

Python 3.x
requests

as the basic requirements for the research script.

For defensive research, the PoC should only be examined or executed against a local laboratory environment or systems for which explicit authorization has been granted.

It is also worth noting that the repository's README currently contains a labeling inconsistency: its heading refers to “CVE-2025-4403 Exploit”, while the repository itself, the CVE identifier, and the vulnerability description concern CVE-2025-2294. The actual CVE record identifies the issue as Kubio AI Page Builder's unauthenticated LFI vulnerability.

Security Impact

The impact depends on the configuration of the vulnerable WordPress installation and the files accessible to the application's PHP process.

A vulnerable installation could potentially face:

1. Sensitive File Disclosure

An attacker may be able to cause the application to access local files that were not intended to be exposed through the web application.

2. Access-Control Bypass

Because the vulnerable functionality can be reached without authentication, the issue can bypass normal application-level restrictions around authenticated functionality.

3. Configuration Exposure

Files containing application configuration or environment information may become valuable targets if they are accessible through the vulnerable file-loading mechanism.

4. Potential Code Execution

The CVE description notes that arbitrary PHP code contained in included files may be executed in applicable scenarios. This makes the vulnerability significantly more serious than a simple file disclosure issue.

5. Further Website Compromise

Successful exploitation in a suitable environment could become a stepping stone toward broader compromise of the WordPress installation.

The CVSS score of 9.8 Critical reflects the combination of remote reachability, lack of authentication requirements, and potentially high impact.

Detection and Mitigation

Administrators should first determine whether the Kubio AI Page Builder plugin is installed and identify its current version.

The vulnerability was patched in version 2.5.2, so installations running 2.5.1 or earlier should be upgraded. Current WordPress plugin listings also show versions newer than 2.5.2, meaning administrators should generally use the latest available version rather than stopping at the minimum patched version.

Recommended defensive actions include:

• Update Kubio AI Page Builder to a current patched version.
• Remove the plugin if it is unnecessary.
• Review web-server logs for suspicious requests involving template-loading functionality.
• Monitor the filesystem for unexpected modifications.
• Restrict application file-access operations to known directories.
• Canonicalize and validate paths before accessing local files.
• Prevent path traversal outside explicitly permitted directories.
• Keep WordPress core, plugins, and themes updated.
• Review sensitive configuration files and permissions.

Security monitoring should also consider that an LFI vulnerability can be used as part of a larger attack chain rather than being treated as an isolated file-access problem.

Conclusion

CVE-2025-2294 is a critical example of how an improperly restricted file-loading function can expose a WordPress installation to serious security risks.

The vulnerability exists in the Kubio AI Page Builder plugin's kubio_hybrid_theme_load_template functionality and allows unauthenticated Local File Inclusion in versions up to and including 2.5.1.

With a CVSS v3.1 score of 9.8, no authentication requirement, and the potential to access sensitive files or execute PHP code in applicable scenarios, this vulnerability should be treated as a high-priority issue for affected WordPress installations.

The vulnerability was patched in Kubio AI Page Builder 2.5.2. Administrators should therefore ensure that vulnerable versions are no longer deployed.

For security researchers, CVE-2025-2294 provides a useful case study for understanding Local File Inclusion, path traversal, secure template loading, WordPress plugin security, and the importance of restricting server-side file access.

SOURCE: CVE-2025-2294 — Yucaerin GitHub Repository

References: NVD — CVE-2025-2294 · Wordfence — CVE-2025-2294