CVE-2025-28916

Critical

Published: 26 March 2025

Published

26 March 2025

Modified

23 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0072 72.9th percentile

Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-28916 is a critical-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 9.8 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 27.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

The vulnerability is a PHP Local File Inclusion flaw (CWE-98) stemming from improper control of filenames in include/require statements. It affects the Docpro WordPress plugin by Rashid, impacting all versions through 2.0.1. The issue carries a CVSS 3.1 score of 9.8, reflecting network-accessible exploitation without authentication or user interaction and full compromise of confidentiality, integrity, and availability.

An unauthenticated attacker can supply a crafted filename parameter over the network to force inclusion of arbitrary local files on the server. Successful exploitation can result in execution of attacker-controlled PHP code, disclosure of sensitive files, or full site takeover depending on the server's configuration and file permissions.

The Patchstack advisory entry for this CVE documents the affected plugin versions and classifies the issue as a local file inclusion vulnerability, directing administrators to apply updates once released by the vendor. The associated EPSS scores remain low, with a current value of 0.0072 and a modest peak of 0.0109.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-8143

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rashid Docpro docpro allows PHP Local File Inclusion.This issue affects Docpro: from n/a through <= 2.0.1.

CWE(s): CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.004 Unix Shell Execution

Adversaries may abuse Unix shell commands and scripts for execution.

attack.mitre.org →

Why these techniques?

The CVE describes an unauthenticated remote LFI vulnerability in a public-facing WordPress plugin that leads to server compromise, directly enabling exploitation of public-facing applications (T1190) and facilitating command/script execution via included PHP files on Unix-based servers (T1059.004).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0