CVE-2025-28979 is a high severity (CVSS 8.1) PHP file inclusion flaw in the ThimPress WP Pipes WordPress plugin, versions through 1.4.3. A filename used in an include statement is not controlled properly, allowing local file inclusion. Patchstack lists no official patch, so remove the plugin.
What's affected
The record says ThimPress WP Pipes from n/a through 1.4.3 is affected. The Patchstack page we fetched lists 1.4.3 as the vulnerable version and states that no official patch is available. Patchstack also marks the issue as a high priority one.
The record titles the weakness as improper control of the filename for an include or require statement in a PHP program, and says it allows local file inclusion. The attack complexity is high, which accounts for the score of 8.1 rather than 9.8.
Severity in the record: high, CVSS 8.1, vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Weakness classes: CWE-98 (Improper control of filename for include or require).
How to check if you're exposed
List the plugin and its version with WP-CLI:
wp plugin list --name=wp-pipes
Or open the Plugins screen and look for WP Pipes. Version 1.4.3 and anything earlier is in the range.
If you manage many WordPress sites, check them all, including staging copies. Also search your access logs for requests to paths under /wp-content/plugins/wp-pipes/ from addresses that are not yours.
What to do now
- Deactivate and remove WP Pipes if you do not need it. With no official patch listed, removal is the cleanest fix.
- If you need it, check the vendor and Patchstack for a fixed release, and apply it at once.
- Put a web application firewall in front of the site and enable rules for WordPress plugin attacks, keeping in mind it is a stopgap.
- Back up the site and database, and keep a copy offline.
- Review users, scheduled tasks and recently changed files for anything you did not do.
- Rotate the database password and WordPress salts if you suspect the site was reached.
Why it matters
CWE-98 covers PHP programs that build the name of a file to include from input. PHP runs whatever it includes, so if a request can influence which file is included, the site may run code from a file that was never meant to be executed, or reveal the contents of one. The risk grows if the attacker can also place content on the server, for example through an upload or log file.
The record notes high attack complexity (AC:H) and no privileges required. It scores high impact on all three properties. Safe code uses a fixed list of files that may be included, and never passes request data to an include statement. Since the plugin has no patch listed, you cannot rely on the vendor for that and should remove it if you can.
The record does not flag this CVE as known exploited (it is not on the CISA Known Exploited Vulnerabilities list as of the record), so treat it as a patching priority rather than an active incident, and keep watching the advisory.
Quick check
Is there a patch for CVE-2025-28979?
Patchstack says no official patch is available for versions up to 1.4.3. Check the plugin page for news and consider removal.
Is CVE-2025-28979 known to be exploited?
The record does not flag it as known exploited. Patchstack describes this class of issue as one used in mass exploitation campaigns, so act promptly.
Sources
Last reviewed: 19 October 2026.
