Cyber Resilience

CVE-2025-39399

High

Published: 24 April 2025

Published
24 April 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0046 64.6th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-39399 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 35.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

The vulnerability is a PHP Local File Inclusion issue stemming from improper control of filenames in include/require statements, tracked as CWE-98. It affects the License For Envato WordPress plugin by Ashraful Sarkar Naiem, with all versions through 1.0.0 impacted. The flaw carries a CVSS 3.1 score of 7.5.

Remote attackers can exploit the issue over the network without authentication, though high attack complexity and user interaction are required. Successful exploitation can yield high impact on confidentiality, integrity, and availability by allowing an attacker to include arbitrary local files within the PHP application.

The Patchstack advisory at the referenced URL documents the vulnerability in the wordpress-license-envato plugin and serves as the primary source for further details on affected code paths.

EPSS for the CVE rose from a low baseline to a peak of 0.0217 on 2026-06-02 before receding to the current value of 0.0046, indicating a post-disclosure increase in exploitation interest.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ashraful Sarkar Naiem License For Envato license-envato allows PHP Local File Inclusion.This issue affects License For Envato: from n/a through <= 1.0.0.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References