CVE-2025-39526
Published: 17 April 2025
Summary
CVE-2025-39526 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 16.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-39526 is a PHP Local File Inclusion vulnerability (CWE-98) caused by improper control of filenames in include/require statements. It affects the nicdark Hotel Booking (nd-booking) WordPress plugin in all versions through 3.6. The flaw carries a CVSS 3.1 score of 8.1, reflecting network attack vector, high complexity, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can supply a crafted filename parameter to force the plugin to include arbitrary local files on the server. Successful exploitation can expose sensitive configuration data, enable arbitrary code execution via included PHP files, or facilitate further compromise of the WordPress installation and underlying host.
The public advisory published by Patchstack details the affected plugin versions and links to the corresponding vulnerability record for remediation guidance.
EPSS for this CVE rose from a low baseline to a peak of 0.0371, indicating emerging exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-11738
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in nicdark Hotel Booking nd-booking allows PHP Local File Inclusion.This issue affects Hotel Booking: from n/a through <= 3.6.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.