Cyber Resilience

CVE-2025-39452

High

Published: 17 April 2025

Published
17 April 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0050 66.3th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-39452 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 33.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2025-39452 is a PHP Local File Inclusion vulnerability arising from improper control of filenames in include or require statements. It affects the WPCafe plugin for WordPress developed by Arraytics, with all versions through 2.2.32 impacted. The flaw is tracked under CWE-98 and carries a CVSS 3.1 score of 7.5.

An attacker with low-privileged network access can supply a crafted filename to force inclusion of arbitrary local files on the server. Successful exploitation can yield full control over confidentiality, integrity, and availability of the affected WordPress installation.

The primary advisory is published by Patchstack at the referenced URL and identifies the issue in WPCafe 2.2.32. EPSS scores remain low, with a current value of 0.0050 and a recorded peak of 0.0121.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Arraytics WPCafe wp-cafe allows PHP Local File Inclusion.This issue affects WPCafe: from n/a through <= 2.2.32.

CWE(s)
CWE-98

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References