CVE-2025-39379
Published: 24 April 2025
Summary
CVE-2025-39379 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 30.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a PHP Local File Inclusion issue stemming from improper control of filenames in include/require statements, tracked as CWE-98. It affects the Capturly WordPress plugin (capturly-optimize-your-website) in versions up to and including 2.0.1, and carries a CVSS 3.1 score of 7.5.
An unauthenticated remote attacker can exploit the flaw over the network, though successful exploitation requires high attack complexity and user interaction. Successful abuse can result in high impacts to confidentiality, integrity, and availability on the affected site.
The issue is documented in the Patchstack advisory for the Capturly plugin, which identifies the affected versions and serves as the primary public reference for the vulnerability.
EPSS for the CVE rose from a low baseline to a peak of 0.0270 on 2026-06-02 before receding to the current value of 0.0058, indicating that exploitation interest emerged after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-12083
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Capturly Capturly capturly-optimize-your-website allows PHP Local File Inclusion.This issue affects Capturly: from n/a through <= 2.0.1.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.