Cyber Resilience

CVE-2025-26932

High

Published: 25 February 2025

Published
25 February 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0061 70.2th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26932 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 29.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).

Deeper analysis

The vulnerability is a PHP Local File Inclusion issue stemming from improper control of filenames in include/require statements, tracked as CWE-98. It affects the ChatBot plugin (also known as WPBot) by QuantumCloud for WordPress, in all versions through 6.3.5.

An attacker with low privileges and network access can exploit the flaw, though the attack requires high complexity. Successful exploitation can result in disclosure or modification of sensitive files and other high-impact outcomes on confidentiality, integrity, and availability.

The single reference points to a Patchstack advisory entry for the WordPress WPBot plugin that catalogs the local file inclusion vulnerability. EPSS scores remain low, with a current value of 0.0061 against a recorded peak of 0.0119.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in QuantumCloud ChatBot chatbot allows PHP Local File Inclusion.This issue affects ChatBot: from n/a through <= 6.3.5.

CWE(s)
CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The CVE describes a network-exploitable vulnerability (AV:N) in a public-facing WordPress plugin allowing local/remote file inclusion with high impact, directly enabling initial access via exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-28087Shared CWE-98
CVE-2025-23952Shared CWE-98
CVE-2026-32505Shared CWE-98
CVE-2025-48149Shared CWE-98
CVE-2025-60058Shared CWE-98
CVE-2025-49994Shared CWE-98
CVE-2026-24531Shared CWE-98
CVE-2025-67527Shared CWE-98
CVE-2025-69396Shared CWE-98
CVE-2025-62067Shared CWE-98

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the vulnerability by requiring identification, reporting, and timely patching of the flawed PHP include/require handling in vulnerable ChatBot plugin versions <=6.3.5.

SI-10 Information Input Validation good match
prevent

Enforces validation of untrusted filenames passed to PHP include/require statements, preventing local file inclusion exploitation.

RA-5 Vulnerability Monitoring and Scanning good match
detectrespond

Scans for and remediates vulnerabilities like CVE-2025-26932 in WordPress plugins, enabling proactive discovery and flaw correction.

References