CVE-2025-39391
Published: 24 April 2025
Summary
CVE-2025-39391 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 31.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a PHP Local File Inclusion issue, classified under CWE-98 as improper control of filenames in include/require statements. It affects the Checkout Field Visibility for WooCommerce WordPress plugin in all versions through 1.3.0.
An unauthenticated remote attacker can supply a crafted filename parameter to force inclusion of arbitrary local files on the server. Successful exploitation, which requires user interaction and carries high attack complexity, can result in disclosure of sensitive information or execution of attacker-controlled code, yielding full confidentiality, integrity, and availability impact.
The Patchstack advisory linked in the CVE record identifies the flaw and points to an updated plugin release that resolves the file-inclusion vector.
EPSS for the CVE rose from a low baseline to a peak of 0.0217 on 2026-06-02 before receding, indicating a measurable increase in exploitation interest after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-12070
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zamartz Checkout Field Visibility for WooCommerce checkout-field-visibility-for-woocommerce allows PHP Local File Inclusion.This issue affects Checkout Field Visibility for WooCommerce: from n/a through <= 1.3.0.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.