CVE-2025-28979: WordPress WP Pipes <= 1.4.3

Record summary

CVE-2025-28979 has a selected CVSS score of 8.1 (high).

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in ThimPress WP Pipes allows PHP Local File Inclusion. This issue affects WP Pipes: from n/a through 1.4.3.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone

AutomatableNo

Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 14, 2025 · Source: CVE List

Affected products and versions

Product	Source	Version range	Status
WP Pipes Browse ThimPress / WP Pipes Default status: unaffected	CVE List	Through 1.4.3	affected

References

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2025-28979

patchstack.comvdb entry

https://patchstack.com/database/wordpress/plugin/wp-pipes/vulnerability/wordpress-wp-pipes-1-4-3-local-file-inclusion-vulnerability?_s_id=cve