Cyber Resilience

CVE-2025-39391

High

Published: 24 April 2025

Published
24 April 2025
Modified
29 April 2026
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0055 68.5th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-39391 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 31.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

The vulnerability is a PHP Local File Inclusion issue, classified under CWE-98 as improper control of filenames in include/require statements. It affects the Checkout Field Visibility for WooCommerce WordPress plugin in all versions through 1.3.0.

An unauthenticated remote attacker can supply a crafted filename parameter to force inclusion of arbitrary local files on the server. Successful exploitation, which requires user interaction and carries high attack complexity, can result in disclosure of sensitive information or execution of attacker-controlled code, yielding full confidentiality, integrity, and availability impact.

The Patchstack advisory linked in the CVE record identifies the flaw and points to an updated plugin release that resolves the file-inclusion vector.

EPSS for the CVE rose from a low baseline to a peak of 0.0217 on 2026-06-02 before receding, indicating a measurable increase in exploitation interest after public disclosure.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in zamartz Checkout Field Visibility for WooCommerce checkout-field-visibility-for-woocommerce allows PHP Local File Inclusion.This issue affects Checkout Field Visibility for WooCommerce: from n/a through <= 1.3.0.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References