Post Slides <= 1.0.1 - Contributor+ Lokale Datei-Inklusion (Local File Inclusion)

The LFI vulnerability in Post Slides allows an attacker who has authenticated access to the WordPress site (e.g., a contributor or editor) to manipulate shortcode attributes to include arbitrary files. This means an attacker could potentially read sensitive files such as wp-config.php (containing database credentials), theme files, or other configuration files. Successful exploitation could lead to unauthorized access to the database, compromise of the entire WordPress site, and potential data exfiltration. While the vulnerability requires authentication, the widespread use of WordPress and the ease of obtaining contributor-level access make this a significant risk.

WordPress websites using the Post Slides plugin, particularly those with multiple users having contributor or higher roles, are at risk. Shared hosting environments where users have limited control over plugin configurations are also particularly vulnerable. Sites with outdated WordPress installations or weak security practices are at increased risk.

• wordpress / composer / npm:

grep -r "include(get_include_path()" /var/www/html/wp-content/plugins/post-slides/

• wordpress / composer / npm:

wp plugin list --status=all | grep "post-slides"

• generic web:

curl -I http://your-wordpress-site.com/wp-content/plugins/post-slides/ | grep -i "include"

1. 2026-02-07Disclosure

   disclosure

1. Reserviert2026-01-08
2. Veröffentlicht2026-02-07
3. Geändert2026-04-02
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-15491 is to upgrade the Post Slides plugin to a version that addresses the vulnerability. Until a patch is available, consider restricting file access permissions on the WordPress server to minimize the potential impact of a successful exploit. Implement a Web Application Firewall (WAF) with rules to block suspicious requests containing manipulated shortcode attributes. Regularly review WordPress user roles and permissions to ensure that only necessary access is granted. Monitor WordPress logs for unusual file access patterns.