CVE-2025-26760
Published: 22 February 2025
Summary
CVE-2025-26760 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 30.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
The vulnerability is a PHP Local File Inclusion flaw stemming from improper control of filenames in include/require statements, tracked as CWE-98. It affects the Calculator Builder plugin for WordPress developed by Wow-Company, with all versions through 1.6.2 impacted.
An unauthenticated remote attacker can exploit the issue over the network, though successful exploitation requires high attack complexity and user interaction. If leveraged, the flaw permits local file inclusion that can result in high impact to confidentiality, integrity, and availability on the affected site.
The sole reference points to a Patchstack advisory entry that catalogs the WordPress plugin vulnerability and its affected versions. The EPSS score remains low, with a recorded peak of only 0.0115.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4429
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Wow-Company Calculator Builder calculator-builder allows PHP Local File Inclusion.This issue affects Calculator Builder: from n/a through <= 1.6.2.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The LFI vulnerability in a public-facing WordPress plugin directly enables exploitation of public-facing applications via T1190. It also facilitates data collection from the local system (T1005) by allowing inclusion of sensitive files, potentially leading to disclosure or further impacts as described.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates CVE-2025-26760 by requiring timely flaw remediation through patching the vulnerable Calculator Builder WordPress plugin versions <=1.6.2.
Prevents exploitation of the improper filename control in PHP include/require statements by enforcing validation of inputs to block local file inclusion attacks.
Restricts user or administrator installation of unapproved third-party software like the vulnerable Calculator Builder plugin, reducing exposure to this LFI vulnerability.