Cyber Resilience

CVE-2025-39526

High

Published: 17 April 2025

Published
17 April 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0185 83.4th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-39526 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, ranked in the top 16.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2025-39526 is a PHP Local File Inclusion vulnerability (CWE-98) caused by improper control of filenames in include/require statements. It affects the nicdark Hotel Booking (nd-booking) WordPress plugin in all versions through 3.6. The flaw carries a CVSS 3.1 score of 8.1, reflecting network attack vector, high complexity, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

An unauthenticated remote attacker can supply a crafted filename parameter to force the plugin to include arbitrary local files on the server. Successful exploitation can expose sensitive configuration data, enable arbitrary code execution via included PHP files, or facilitate further compromise of the WordPress installation and underlying host.

The public advisory published by Patchstack details the affected plugin versions and links to the corresponding vulnerability record for remediation guidance.

EPSS for this CVE rose from a low baseline to a peak of 0.0371, indicating emerging exploitation interest after disclosure.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allows PHP Local File Inclusion.This issue affects Hotel Booking: from n/a through <= 3.6.

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References