Official Product Homepageproduct
http://simple-fields.com/ CVE-2018-25324
MEDIUM
Simple Fields 0.2-0.3.5 Local File Inclusion via wp_abspath
Record summary
CVE-2018-25324 has a selected CVSS score of 6.9 (medium); EIP currently links 1 catalogued exploit.
Description
Simple Fields 0.2 through 0.3.5 WordPress Plugin contains a local file inclusion vulnerability that allows unauthenticated attackers to read arbitrary files by injecting null bytes into the wp_abspath parameter on PHP versions before 5.3.4. Attackers can supply malicious wp_abspath values to simple_fields.php to include files like /etc/passwd or inject PHP code into Apache logs for remote code execution when allow_url_include is enabled.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 1
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated May 18, 2026 · Source: CVE List
Affected products and versions
1| Product | Source | Version range | Status |
|---|---|---|---|
Simple FieldsBrowse Simple-Fields / Simple Fields | CVE List | 0.2 to ≤ 0.3.5 | affected |
Proofs of concept
1Catalogued exploits
ExploitDBWordPress Plugin Simple Fields 0.2 - 0.3.5 - Local/Remote File Inclusion / Remote Code ExecutionExploitDB exploitby Graeme RobinsonNot analyzed1 file
References
5Product Referenceproduct
https://downloads.wordpress.org/plugin/simple-fields.0.3.5.zip nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2018-25324 ExploitDB-44425exploit
https://www.exploit-db.com/exploits/44425 VulnCheck Advisory: Simple Fields 0.2-0.3.5 Local File Inclusion via wp_abspathThird-party advisory
https://www.vulncheck.com/advisories/simple-fields-local-file-inclusion-via-wp-abspath