CVE-2025-39383
Published: 24 April 2025
Summary
CVE-2025-39383 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 25.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2025-39383 is an instance of improper control of filename for include/require statements in a PHP program, classified as a PHP Local File Inclusion flaw under CWE-98. It affects the Xews Lite WordPress theme from codeworkweb in all versions through 1.0.9.
An unauthenticated remote attacker can exploit the issue by supplying crafted input that forces inclusion of arbitrary local files on the server. Successful exploitation can yield high impact on confidentiality, integrity, and availability, consistent with the CVSS 3.1 score of 7.5 requiring high attack complexity and user interaction.
The Patchstack advisory identifies the local file inclusion vulnerability in Xews Lite version 1.0.9 and provides the associated remediation reference.
EPSS for the CVE rose from a low baseline to a peak of 0.0270 on 2026-06-04 before receding to the current value of 0.0079.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-12082
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in codeworkweb Xews Lite xews-lite allows PHP Local File Inclusion.This issue affects Xews Lite: from n/a through <= 1.0.9.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.