CVE-2025-9990

High

Published: 05 September 2025

Published

05 September 2025

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0044 63.5th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-9990 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 36.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-9990 is a Local File Inclusion (LFI) vulnerability, classified under CWE-98, in the WordPress Helpdesk Integration plugin for WordPress. It affects all versions up to and including 5.8.10 and is exploitable via the portal_type parameter. The flaw enables the inclusion and execution of arbitrary .php files on the server, allowing PHP code execution from those files. The vulnerability has a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high severity with network accessibility but high attack complexity.

Unauthenticated attackers can exploit this vulnerability remotely without privileges or user interaction. By manipulating the portal_type parameter, they can include arbitrary .php files, leading to PHP code execution. This can bypass access controls, disclose sensitive data, or enable full remote code execution if .php file uploads are possible through other means on the target system.

Mitigation details are available in related advisories and source code references, including the Wordfence threat intelligence report at https://www.wordfence.com/threat-intel/vulnerabilities/id/49a935cc-7b95-4abd-9a4d-c7e14c765863?source=cve, as well as WordPress plugin repository files at https://plugins.svn.wordpress.org/wp-helpdesk-integration/trunk/index.php and https://plugins.trac.wordpress.org/browser/wp-helpdesk-integration/trunk/index.php#L85.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-26999

Vulnerability details

The WordPress Helpdesk Integration plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 5.8.10 via the portal_type parameter. This makes it possible for unauthenticated attackers to include and execute arbitrary .php files on…

the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where .php file types can be uploaded and included.