Analysis Summary

CVE-2025-31387 CVSS:7.5

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in InstaWP InstaWP Connect allows PHP Local File Inclusion. This issue affects InstaWP Connect: from n/a through 0.1.0.82.

CVE-2025-31016 CVSS:7.5

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NotFound JetWooBuilder allows PHP Local File Inclusion. This issue affects JetWooBuilder: from n/a through 2.1.18.

Impact

• Gain Access

Indicators of Compromise

CVE

• CVE-2025-31387

• CVE-2025-31016

Affected Vendors

Remediation

Update the WordPress plugin to the latest available version.

CVE-2025-31387

CVE-2025-31016