CVE-2025-39384
Published: 24 April 2025
Summary
CVE-2025-39384 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 26.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2025-39384 is a PHP Local File Inclusion flaw caused by improper control of filenames in include/require statements within PHP code. It affects the cedcommerce Product Lister for eBay WordPress plugin in all versions through 2.0.9 and is tracked under CWE-98 with a CVSS 3.1 score of 7.5.
An unauthenticated remote attacker can exploit the issue by supplying a crafted filename that is processed by the plugin, provided they can induce a user with a browser session to perform specific actions. Successful exploitation grants the ability to include arbitrary local files on the server, which can result in disclosure of sensitive information, modification of application behavior, or full compromise of confidentiality, integrity, and availability.
The public advisory published by Patchstack identifies the affected plugin versions and links the issue directly to the reported local file inclusion vector. The associated EPSS score remains low with only a minor increase between its recorded current and peak values.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-12081
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cedcommerce Product Lister for eBay product-lister-ebay allows PHP Local File Inclusion.This issue affects Product Lister for eBay: from n/a through <= 2.0.9.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.