CVE-2025-62868
Published: 24 October 2025
Summary
CVE-2025-62868 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-62868 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified under CWE-98 and described as enabling PHP Local File Inclusion, in the Edge-Themes Edge CPT WordPress plugin. This issue affects all versions of Edge CPT from n/a through 1.4. Published on 2025-10-24, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated remote attackers can exploit this vulnerability over the network without user interaction, though exploitation requires high attack complexity. Successful attacks can result in high impacts to confidentiality, integrity, and availability, potentially allowing attackers to include and execute local PHP files.
Patchstack has documented this vulnerability in its database for the Edge CPT WordPress plugin version 1.4, providing details under its security policy and vulnerability disclosure program; practitioners should consult the advisory at https://patchstack.com/database/wordpress/plugin/edge-cpt/security-policy/vdp/vulnerability/wordpress-edge-cpt-plugin-1-4-local-file-inclusion-vulnerability?_s_id=cve for mitigation guidance.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-35824
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Edge-Themes Edge CPT allows PHP Local File Inclusion.This issue affects Edge CPT: from n/a through 1.4.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is an LFI in a public-facing WordPress plugin exploitable remotely for RCE and sensitive data disclosure, directly enabling T1190: Exploit Public-Facing Application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely patching of the vulnerable Edge CPT WordPress plugin versions up to 1.4.
Enforces validation of filenames and paths in PHP include/require statements to block local file inclusion exploits.
Establishes secure PHP and WordPress configuration settings, such as open_basedir restrictions, to limit the impact of improper file inclusion controls.