CVE-2025-9991: WordPress Tiny Bootstrap Elements RCE Flaw

CVE-2025-9991 Overview

The Tiny Bootstrap Elements Light plugin for WordPress contains a Local File Inclusion (LFI) vulnerability in all versions up to and including 4.3.34. The vulnerability exists in the language parameter, which allows unauthenticated attackers to include and execute arbitrary .php files on the server. This critical flaw enables the execution of any PHP code within those files, potentially leading to complete server compromise.

Critical Impact
Unauthenticated attackers can exploit this vulnerability to execute arbitrary PHP code, bypass access controls, obtain sensitive data, and achieve full code execution on affected WordPress installations.

Affected Products

Tiny Bootstrap Elements Light WordPress Plugin version 4.3.34 and earlier
WordPress installations using vulnerable versions of the plugin
Any server hosting affected WordPress sites with this plugin active

Discovery Timeline

September 30, 2025 - CVE-2025-9991 published to NVD
October 02, 2025 - Last updated in NVD database

Technical Details for CVE-2025-9991

Vulnerability Analysis

This Local File Inclusion vulnerability resides in the bootstrap-label.php file within the plugin's assets directory. The language parameter fails to properly sanitize user input before including files, allowing attackers to manipulate the file path and include arbitrary PHP files from the server's filesystem. Since the vulnerability is accessible to unauthenticated users, any attacker with network access to the WordPress site can exploit this flaw without needing any credentials or prior authentication.

The attack complexity is rated as high, indicating that while exploitation requires some specific conditions, successful attacks can result in complete confidentiality, integrity, and availability impact. When combined with the ability to upload PHP files through other means (such as media uploads or other vulnerabilities), attackers can achieve full remote code execution.

Root Cause

The root cause of this vulnerability is improper input validation (CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program). The vulnerable code in bootstrap-label.php directly uses the user-supplied language parameter in a file inclusion operation without adequate sanitization or path validation. This allows attackers to traverse directories and include files outside the intended scope, or include malicious PHP files that may have been uploaded to the server.

Attack Vector

The attack is network-based and requires no authentication. An attacker can craft a malicious HTTP request targeting the vulnerable bootstrap-label.php endpoint with a manipulated language parameter. By using path traversal sequences or pointing to uploaded malicious files, the attacker can force the server to include and execute arbitrary PHP code.

The exploitation scenario typically involves:

Identifying a WordPress site running Tiny Bootstrap Elements Light plugin version 4.3.34 or earlier
Crafting a request to the vulnerable endpoint with a manipulated language parameter
Including a malicious PHP file (either pre-existing on the server or uploaded through another method)
Achieving code execution with the privileges of the web server process

For detailed technical analysis of the vulnerable code, refer to the WordPress Plugin Code Review.

Detection Methods for CVE-2025-9991

Indicators of Compromise

Unusual HTTP requests to /wp-content/plugins/tiny-bootstrap-elements-light/assets/bootstrap-label.php with suspicious language parameter values
Path traversal sequences (../, ..%2f) in request parameters targeting the plugin
Unexpected PHP file access or execution in web server logs
Creation of new PHP files in writable directories that could be included
Web shell artifacts or backdoor files on the server

Detection Strategies

Monitor web application firewall (WAF) logs for LFI attack patterns targeting WordPress plugins
Implement file integrity monitoring on WordPress installations to detect unauthorized changes
Review web server access logs for requests containing path traversal patterns
Deploy WordPress-specific security plugins that can detect and block LFI attempts
Use SentinelOne's behavioral AI to detect post-exploitation activity such as unauthorized process execution

Monitoring Recommendations

Enable detailed logging for all requests to WordPress plugin directories
Configure alerts for suspicious file inclusion patterns in the language parameter
Monitor for unusual outbound connections from the web server that may indicate command and control activity
Track file system changes in WordPress plugin directories for signs of tampering
Implement real-time monitoring with SentinelOne Singularity to detect malicious PHP execution

How to Mitigate CVE-2025-9991

Immediate Actions Required

Update Tiny Bootstrap Elements Light plugin to a patched version immediately if available
If no patch is available, deactivate and remove the plugin from all WordPress installations
Review web server logs for evidence of exploitation attempts
Conduct a thorough security audit of affected WordPress sites for signs of compromise
Implement Web Application Firewall (WAF) rules to block LFI attack patterns

Patch Information

Check the Wordfence Vulnerability Report for the latest patch information and vendor advisories. WordPress administrators should monitor the plugin's update channel and apply security patches as soon as they become available.

Workarounds

Disable the Tiny Bootstrap Elements Light plugin until a patch is released
Implement server-side input validation to block path traversal sequences in the language parameter
Use a WAF to filter requests containing LFI attack patterns
Restrict file system permissions to limit the impact of potential exploitation
Consider using a WordPress security plugin with virtual patching capabilities

bash

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate tiny-bootstrap-elements-light

# Verify plugin is deactivated
wp plugin list --status=inactive | grep tiny-bootstrap-elements-light

# Optional: Remove the plugin entirely until patched
wp plugin delete tiny-bootstrap-elements-light