CVE-2025-26933

High

Published: 10 March 2025

Published

10 March 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Score 0.0113 78.7th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-26933 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-26933 is a PHP Local File Inclusion vulnerability arising from improper control of filenames in include/require statements. It affects the WC Place Order Without Payment plugin for WooCommerce on WordPress, impacting all versions through 2.6.7.

An unauthenticated remote attacker can exploit the flaw by supplying a crafted filename parameter that causes the plugin to include arbitrary local files. Successful exploitation grants the attacker the ability to read sensitive files or execute limited code on the server, resulting in high confidentiality, integrity, and availability impact despite the high attack complexity and required user interaction.

The Patchstack advisory for the vulnerability recommends updating the plugin to a fixed version beyond 2.6.7 to remediate the issue.

EPSS for this CVE rose from a low baseline to a peak of 0.0257, indicating emerging exploitation interest after public disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-7720

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nitin Prakash WC Place Order Without Payment wc-place-order-without-payment allows PHP Local File Inclusion.This issue affects WC Place Order Without Payment: from n/a through <=…

2.6.7.

CWE(s): CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The CVE describes a local file inclusion vulnerability in a publicly accessible WordPress plugin, directly enabling exploitation of public-facing applications via T1190.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0