CVE-2025-2294

What it actually does

Kubio AI Page Builder for WordPress versions up to and including 2.5.1 contains an unauthenticated local file inclusion weakness in the kubio_hybrid_theme_load_template function. An attacker can influence which server-side file is loaded as a template, allowing path traversal or stream-wrapper abuse to include unintended local files. If the included file contains PHP code, the web server may execute it in the WordPress context, potentially turning the flaw from file disclosure into remote code execution. This can expose configuration secrets, bypass WordPress access controls, execute attacker-supplied PHP from uploadable files, and compromise the integrity and availability of the site.

Why it matters to the business

A vulnerable WordPress site can be taken over remotely without requiring a valid user account. Successful exploitation may allow theft of site data, database credentials, customer information, administrator session material, or full deployment of web shells and malware. Because the CVSS score is critical, EPSS is high, the issue is weaponized, and it has been public for a long time, internet-facing sites running affected plugin versions should be treated as high-priority remediation targets even though the vulnerability is not currently listed in CISA KEV.

How an attack unfolds

An attacker first identifies a WordPress site using the Kubio AI Page Builder plugin at a vulnerable version. They then send crafted unauthenticated requests that cause the vulnerable template-loading function to resolve an attacker-controlled file path instead of an intended template. In a lower-impact scenario, the attacker includes readable local files such as WordPress configuration files or logs to obtain secrets. In a higher-impact scenario, the attacker first places PHP content somewhere the server can read, such as an uploaded media file, writable cache file, log file, or another upload location, and then triggers the inclusion path so that PHP code in that file executes under the web server account. After code execution, the attacker may deploy a web shell, create or modify WordPress administrator users, alter plugin or theme files, exfiltrate database contents, inject spam or skimmers, or use the server as a foothold for broader activity.

How to fix it

Upgrade the Kubio AI Page Builder plugin to a vendor-fixed release newer than 2.5.1 as soon as possible. If no fixed release is available through the normal WordPress update channel, disable and remove the plugin until a patched version can be installed. Restrict direct access to WordPress administrative and plugin endpoints where feasible, but do not rely on access controls alone because the vulnerability is unauthenticated. Review file upload controls to prevent executable content from being uploaded or interpreted as PHP, disable PHP execution in upload directories, and enforce web server rules that block PHP execution from wp-content/uploads and other writable paths. Rotate WordPress database credentials, API keys, and salts if there is any indication that configuration files were accessed. After patching, remove unknown plugin/theme files, suspicious upload artifacts, and unauthorized administrator accounts.

How to confirm the fix worked

Confirm that the installed Kubio AI Page Builder plugin version is newer than 2.5.1 or that the plugin is fully removed. Validate through the WordPress admin plugin inventory, filesystem inspection under wp-content/plugins, and software composition or vulnerability scanners. Verify that unauthenticated requests can no longer cause arbitrary template paths to be loaded and that traversal payloads, PHP stream wrappers, and attempts to include files outside intended template directories are rejected. Confirm web server configuration prevents PHP execution from upload and cache directories. Run a post-remediation scan of WordPress core, plugins, themes, and writable directories for unexpected PHP files, recently modified files, and unauthorized users.

Typical attack path

1. Scan internet-facing WordPress sites for evidence of the Kubio AI Page Builder plugin.
2. Determine whether the plugin version is 2.5.1 or earlier, or attempt exploitation opportunistically when version information is hidden.
3. Send unauthenticated requests that manipulate the template-loading path handled by kubio_hybrid_theme_load_template.
4. Use traversal sequences or PHP stream wrappers to include unintended local files.
5. Read sensitive files such as WordPress configuration, logs, or application files to obtain credentials or secrets.
6. If file upload or writable-file placement is available, place PHP code in a readable location and include it through the vulnerable function.
7. Execute commands or PHP code in the WordPress/web server context.
8. Persist by deploying a web shell, adding an administrator account, modifying plugin/theme files, or scheduling recurring malicious tasks.
9. Exfiltrate data, inject malicious content, redirect visitors, or use the compromised server for additional attacks.

How to detect it

Review historical web access logs, WAF logs, PHP error logs, WordPress debug logs, endpoint telemetry, and file integrity monitoring data for activity targeting the Kubio plugin. Focus on unauthenticated requests that reference Kubio paths or functions and contain path traversal sequences, URL-encoded traversal, null-byte style payloads, or PHP stream wrappers such as php://filter, php://input, data://, zip://, phar://, or expect://. Look for attempts to read wp-config.php, /etc/passwd, server logs, or files under wp-content/uploads. Investigate PHP warnings or fatal errors mentioning kubio_hybrid_theme_load_template, failed include/open_basedir restrictions, or unexpected template paths. For compromise assessment, search for newly created or recently modified PHP files in writable directories, especially wp-content/uploads, wp-content/cache, temporary directories, and plugin/theme directories. Check WordPress audit logs and database-backed activity logs, where available, for new administrator users, plugin/theme editor use, installation of unknown plugins, suspicious option changes, or unexpected cron events. Review outbound network telemetry from web servers for unusual command-and-control connections, data exfiltration, or malware download attempts after suspicious Kubio-related requests.

• kubio_hybrid_theme_load_template
• /wp-content/plugins/kubio/
• ../wp-config.php
• ..%2fwp-config.php
• ..%252fwp-config.php
• ../../../../
• ..%2f..%2f..%2f..%2f
• php://filter
• php%3A%2F%2Ffilter
• php://input
• data://
• zip://
• phar://
• expect://
• /etc/passwd
• wp-config.php
• /wp-content/uploads/*.php
• /wp-content/uploads/*/*.php
• /wp-content/cache/*.php
• failed to open stream: No such file or directory
• failed opening required
• open_basedir restriction in effect
• include(
• require(

What your security team should do

• Immediately inventory WordPress sites for the Kubio AI Page Builder plugin and prioritize any version 2.5.1 or earlier.
• Upgrade to a fixed plugin version newer than 2.5.1, or disable and remove the plugin if a patched release cannot be confirmed.
• Treat exposed vulnerable sites as potentially compromised because exploitation is weaponized and EPSS is high.
• Search web, WordPress, PHP, and endpoint logs for traversal attempts, PHP stream-wrapper usage, suspicious uploads, and unexpected template-loading errors.
• Harden WordPress by disabling PHP execution in writable directories such as wp-content/uploads, limiting plugin/theme file editing, and enforcing least privilege on filesystem permissions.
• Review and remove unauthorized WordPress administrator accounts, unknown plugins, modified theme files, web shells, and suspicious scheduled tasks.
• Rotate database credentials, WordPress salts, and other secrets if wp-config.php or other sensitive local files may have been accessed.
• Add SIEM detections for requests involving the Kubio plugin combined with traversal strings, encoded traversal, or PHP stream wrappers.
• Monitor for post-compromise behavior such as outbound connections from the web server, new PHP files in upload paths, spam redirects, cryptomining, or credential theft indicators.