CVE-2025-39359
Published: 24 April 2025
Summary
CVE-2025-39359 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 30.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The CWW Portfolio WordPress theme from codeworkweb is affected by a PHP Local File Inclusion vulnerability (CWE-98) stemming from improper control of filenames in include/require statements. The flaw impacts all versions through 1.3.1 and carries a CVSS 3.1 score of 7.5.
An unauthenticated remote attacker can exploit the issue over the network, though the attack requires high complexity and user interaction. Successful exploitation grants the ability to include arbitrary local files, resulting in high impact to confidentiality, integrity, and availability.
Patchstack has published details of the vulnerability in its database entry for the theme. The EPSS score rose from a low baseline to a recorded peak of 0.0133, indicating emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-12069
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codeworkweb CWW Portfolio cww-portfolio allows PHP Local File Inclusion.This issue affects CWW Portfolio: from n/a through <= 1.3.1.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.