CVE-2025-39411
Published: 19 May 2025
Summary
CVE-2025-39411 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 21.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a PHP Remote File Inclusion issue (CWE-98) stemming from improper control of filenames in include/require statements. It affects the WhatsApp Click to Chat Plugin for WordPress by Indie_Plugins, specifically all versions through 2.2.12.
An unauthenticated remote attacker can exploit the flaw over the network, though successful exploitation requires high attack complexity and some user interaction. Successful abuse can result in arbitrary file inclusion that compromises confidentiality, integrity, and availability on the affected WordPress site.
The primary public reference is a Patchstack advisory entry that catalogs the local file inclusion vulnerability and its affected plugin versions. No further mitigation details such as specific patch instructions are supplied in the available references.
EPSS remains low and unchanged at 0.0106, indicating no material increase in observed exploitation interest since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-15759
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Indie_Plugins WhatsApp Click to Chat Plugin for WordPress wpt-whatsapp.This issue affects WhatsApp Click to Chat Plugin for WordPress: from n/a through <= 2.2.12.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.