CVE-2025-31432
Published: 28 March 2025
Summary
CVE-2025-31432 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 21.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-6 (Configuration Settings) and SI-10 (Information Input Validation).
Deeper analysis
CVE-2025-31432 is a PHP Local File Inclusion vulnerability (CWE-98) stemming from improper control of filenames in include/require statements. It affects the Chop Chop Pop-Up WordPress plugin in versions up to and including 2.1.7, allowing an attacker to include arbitrary local files through the plugin's code paths.
An authenticated attacker with low privileges can reach the flaw over the network, though exploitation requires high attack complexity. Successful abuse can result in disclosure of sensitive files, modification of application behavior, or full compromise of the confidentiality, integrity, and availability of the affected WordPress site.
The Patchstack advisory at the referenced URL documents the issue and is the primary public source tracking the vulnerability in the plugin.
EPSS scores for the CVE rose from a low baseline to a recorded peak of 0.0211 before settling at the current value of 0.0109, indicating a modest but noticeable increase in exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-8602
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Chop Chop Pop-Up Chop Chop pop-up allows PHP Local File Inclusion.This issue affects Pop-Up Chop Chop: from n/a through <= 2.1.7.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI vulnerability in public-facing WordPress plugin directly enables exploitation of public-facing applications (T1190) and unauthorized access to local system files (T1005).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates improper filename control in PHP include/require by validating user-supplied inputs to prevent local file inclusion attacks.
Requires timely identification, reporting, and patching of the specific flaw in the Pop-Up Chop Chop WordPress plugin to eliminate the LFI vulnerability.
Enforces secure PHP configuration settings such as open_basedir restrictions and disabled URL includes to block unauthorized local file access even if input validation fails.