CVE-2025-2294

CVE-2025-2294 is an unauthenticated local file inclusion (LFI) flaw in the Kubio AI Page Builder plugin for WordPress, present in all versions up to and including 2.5.1 via the thekubio_hybrid_theme_load_template function. An attacker with no credentials can send a crafted request that causes the function to include an attacker-controlled file path from the server, so any PHP code in that file is executed. Beyond bypassing access controls and reading sensitive data, the flaw can escalate to full remote code execution when an attacker can first upload seemingly harmless file types, such as images, that contain embedded PHP. Any WordPress site running Kubio AI Page Builder at version 2.5.1 or earlier is affected. No public proof-of-concept or confirmed in-the-wild exploitation is known yet, but the 78.4% EPSS score (100th percentile) indicates a very high likelihood of exploitation within the next 30 days.

What to do: Update Kubio AI Page Builder to the latest patched release above version 2.5.1 immediately; until patched, deactivate the plugin, since exploitation requires no login or user interaction. Audit recently uploaded files (especially images or other 'safe' types) for embedded PHP payloads, and review web-server access logs for unauthenticated requests hitting template-loading routes.