Cyber Resilience

CVE-2025-39570

High

Published: 16 April 2025

Published
16 April 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0160 82.1th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-39570 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.8 (High).

Operationally, ranked in the top 17.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

The vulnerability CVE-2025-39570 is a PHP Local File Inclusion flaw arising from improper control of filenames in include or require statements. It affects the WPCOM Member WordPress plugin maintained by Lomu, with all versions through 1.7.7 impacted.

Authenticated users with low privileges can exploit the issue remotely without user interaction. Successful attacks allow inclusion of arbitrary local files, resulting in high impact to confidentiality, integrity, and availability.

An advisory published by Patchstack documents the vulnerability in the wpcom-member plugin. The EPSS score reached a peak of 0.0241 against a current value of 0.0160.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Lomu WPCOM Member wpcom-member allows PHP Local File Inclusion.This issue affects WPCOM Member: from n/a through <= 1.7.7.

CWE(s)
CWE-98

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References