CVE-2025-31098
Published: 03 April 2025
Summary
CVE-2025-31098 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 14.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2025-31098 is an improper control of filename for include/require statement in a PHP program, classified as a PHP Local File Inclusion flaw under CWE-98. It affects the DeBounce Email Validator WordPress plugin (debounce-io-email-validator) in versions from n/a through 5.7.
An unauthenticated remote attacker can exploit the issue over the network, though the attack requires high complexity and user interaction. Successful exploitation can result in inclusion of arbitrary local files, yielding high impact to confidentiality, integrity, and availability on the affected installation.
The vulnerability is documented in the Patchstack advisory database for the WordPress plugin, which identifies the affected versions and serves as the primary reference for remediation guidance. The associated EPSS score remains low and unchanged at 0.0232.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-14788
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in debounce DeBounce Email Validator debounce-io-email-validator allows PHP Local File Inclusion.This issue affects DeBounce Email Validator: from n/a through <= 5.7.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.