CVE-2025-15491: LFI in Post Slides WordPress Plugin

The LFI vulnerability in Post Slides allows an attacker with sufficient privileges (contributor or higher) to manipulate shortcode attributes to include arbitrary files. This means an attacker could potentially read sensitive configuration files, source code, or other data stored on the web server. While the vulnerability requires authentication, the widespread use of WordPress and the relatively low barrier to entry for obtaining contributor-level access significantly expands the potential attack surface. Successful exploitation could lead to data breaches, compromise of server credentials, and potentially even remote code execution if the attacker can leverage the included files to execute malicious code.

1. Reserved2026-01-08
2. Published2026-02-07
3. Modified2026-04-02
4. EPSS updated2026-03-23

The primary mitigation for CVE-2025-15491 is to upgrade to a patched version of the Post Slides plugin as soon as it becomes available. Until a patch is released, consider restricting access to the plugin's shortcode functionality or implementing input validation on the server-side to prevent malicious file paths from being constructed. Web application firewalls (WAFs) configured to detect and block LFI attempts can also provide an additional layer of protection. Monitor WordPress plugin activity logs for suspicious file access patterns.