What the vulnerability does
01Description
The Player Leaderboard plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.0.2 via the 'player_leaderboard' shortcode. This is due to the plugin using an unsanitized user-supplied value from the shortcode's 'mode' attribute in a call to include() without proper path validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to include and execute arbitrary PHP files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve full remote code execution if combined with file upload capabilities.
Explanation of Vulnerability in Simple Terms
02Summary
Player Leaderboard versions 1.0.0 through 1.0.2 contain a path traversal vulnerability that allows authenticated users to read and modify arbitrary files on the server. An attacker with low-level access can bypass directory restrictions and access sensitive data or alter critical files. This affects confidentiality, integrity, and availability of the site.
What an attacker can do
03Attacker Capabilities
Read and modify arbitrary files on the server, including configuration and database files.
Potential impact on your site
04Site Impact
Attackers with basic user accounts can steal database credentials, modify site files, or disable the site entirely.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege user account on the site; no user interaction required.
Key dates
06Disclosure timeline
December 12, 2025
CVE published
December 15, 2025
Record updated
