CVE-2025-27264

High

Published: 03 March 2025

Published

03 March 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0112 78.6th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-27264 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

The vulnerability is a PHP Local File Inclusion issue, tracked as CWE-98, in the Creativeitem Doctor Appointment Booking WordPress plugin. It stems from improper control of filenames in include/require statements and affects all versions through 1.0.0.

An attacker with low-privileged network access can exploit the flaw, albeit with high attack complexity, to read or execute arbitrary local files on the server. Successful exploitation yields high impact on confidentiality, integrity, and availability without requiring user interaction.

The issue is catalogued in the Patchstack vulnerability database, which serves as the primary advisory reference for affected plugin users. The associated EPSS score has remained flat at 0.0112 with no observed rise after disclosure.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-5605

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Creativeitem Doctor Appointment Booking doctor-appointment-booking allows PHP Local File Inclusion.This issue affects Doctor Appointment Booking: from n/a through <= 1.0.0.

CWE(s): CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1005 Data from Local System Collection

Adversaries may search local system sources, such as file systems, configuration files, local databases, virtual machine files, or process memory, to find files of interest and sensitive data prior to Exfiltration.

attack.mitre.org →

Why these techniques?

LFI vulnerability in public-facing WordPress plugin directly enables exploitation of public-facing applications for initial access (T1190) and unauthorized access to local files for data collection (T1005).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0