CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

VariantDraftLikelihood: High

Description

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

In certain versions and configurations of PHP, this can allow an attacker to specify a URL to a remote location from which the product will obtain the code to execute. In other cases in association with path traversal, the attacker can specify a local file that may contain executable statements that can be parsed by PHP.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-193

CVEs mapped to this weakness (1,304)

page 10 of 66

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2025-69118	WordPress CopyPress	Hig	0.53	8.1	0.00	Jun 17, 2026	Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions.
CVE-2025-69117	WordPress Ingenioso	Hig	0.53	8.1	0.00	Jun 17, 2026	Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions.
CVE-2025-69116	WordPress Iona	Hig	0.53	8.1	0.00	Jun 17, 2026	Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions.
CVE-2025-69114	WordPress MaxiNet	Hig	0.53	8.1	0.00	Jun 17, 2026	Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions.
CVE-2025-69113	WordPress Nexio	Hig	0.53	8.1	0.00	Jun 17, 2026	Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.
CVE-2025-69112	WordPress Planty	Hig	0.53	8.1	0.00	Jun 17, 2026	Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.
CVE-2025-69110	WordPress AirSupply	Hig	0.53	8.1	0.00	Jun 17, 2026	Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.
CVE-2025-69109	WordPress Raider Spirit	Hig	0.53	8.1	0.00	Jun 17, 2026	Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.
CVE-2025-69107	WordPress Rosaleen	Hig	0.53	8.1	0.00	Jun 17, 2026	Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions.
CVE-2025-69105	WordPress Modernee	Hig	0.53	8.1	0.00	Jun 17, 2026	Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions.
CVE-2025-60085	WordPress Learnify	Hig	0.53	8.1	0.00	Jun 17, 2026	Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions.
CVE-2025-58954	WordPress HomeRoofer	Hig	0.53	8.1	0.00	Jun 17, 2026	Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions.
CVE-2025-58953	WordPress Joly	Hig	0.53	8.1	0.00	Jun 17, 2026	Unauthenticated Local File Inclusion in Joly <= 1.22.0 versions.
CVE-2025-58952	WordPress neuronet	Hig	0.53	8.1	0.00	Jun 17, 2026	Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions.
CVE-2025-58924	WordPress Geya	Hig	0.53	8.1	0.00	Jun 17, 2026	Unauthenticated Local File Inclusion in Geya <= 1.15 versions.
CVE-2026-9662	WordPress Recoverexit For Woocommerce	Hig	0.53	8.1	0.01	Jun 9, 2026	The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.0.3. This is due to insufficient validation and sanitization of the user-controlled `tpf` POST parameter before it is used in an `include()` path in…
CVE-2026-39553	WordPress WaveRide	Hig	0.53	8.1	0.00	Jun 2, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4.
CVE-2026-39552	WordPress Blueprint	Hig	0.53	8.1	0.00	Jun 2, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5.
CVE-2025-69369	WordPress Racquet	Hig	0.53	8.1	0.00	Jun 2, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Racquet allows PHP Local File Inclusion. This issue affects Racquet: from n/a through 1.12.0.
CVE-2025-68886	WordPress Cookiteer	Hig	0.53	8.1	0.00	Jun 2, 2026	Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in androThemes Cookiteer allows PHP Local File Inclusion. This issue affects Cookiteer: from n/a through 1.4.8.

CVE-2025-69118HigJun 17, 2026
WordPress
CopyPress
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in CopyPress <= 1.4.5 versions.
CVE-2025-69117HigJun 17, 2026
WordPress
Ingenioso
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Ingenioso <= 1.14.0 versions.
CVE-2025-69116HigJun 17, 2026
WordPress
Iona
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Iona <= 1.0.8 versions.
CVE-2025-69114HigJun 17, 2026
WordPress
MaxiNet
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in MaxiNet <= 1.2.10 versions.
CVE-2025-69113HigJun 17, 2026
WordPress
Nexio
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Nexio <= 1.10.0 versions.
CVE-2025-69112HigJun 17, 2026
WordPress
Planty
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Planty <= 1.14.0 versions.
CVE-2025-69110HigJun 17, 2026
WordPress
AirSupply
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in AirSupply <= 2.0.0 versions.
CVE-2025-69109HigJun 17, 2026
WordPress
Raider Spirit
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Raider Spirit <= 1.1.2 versions.
CVE-2025-69107HigJun 17, 2026
WordPress
Rosaleen
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Rosaleen <= 2.8 versions.
CVE-2025-69105HigJun 17, 2026
WordPress
Modernee
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Modernee <= 1.6.0 versions.
CVE-2025-60085HigJun 17, 2026
WordPress
Learnify
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Learnify <= 1.15.0 versions.
CVE-2025-58954HigJun 17, 2026
WordPress
HomeRoofer
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in HomeRoofer <= 2.11.0 versions.
CVE-2025-58953HigJun 17, 2026
WordPress
Joly
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Joly <= 1.22.0 versions.
CVE-2025-58952HigJun 17, 2026
WordPress
neuronet
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Neuronet < 1.14.0 versions.
CVE-2025-58924HigJun 17, 2026
WordPress
Geya
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Geya <= 1.15 versions.
CVE-2026-9662HigJun 9, 2026
WordPress
Recoverexit For Woocommerce
risk 0.53cvss 8.1epss 0.01
The Recover Exit For WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to and including 1.0.3. This is due to insufficient validation and sanitization of the user-controlled `tpf` POST parameter before it is used in an `include()` path in…
CVE-2026-39553HigJun 2, 2026
WordPress
WaveRide
risk 0.53cvss 8.1epss 0.00
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Select-Themes WaveRide allows PHP Local File Inclusion. This issue affects WaveRide: from n/a through 1.4.
CVE-2026-39552HigJun 2, 2026
WordPress
Blueprint
risk 0.53cvss 8.1epss 0.00
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Code Supply Co. Blueprint allows PHP Local File Inclusion. This issue affects Blueprint: from n/a before 1.1.5.
CVE-2025-69369HigJun 2, 2026
WordPress
Racquet
risk 0.53cvss 8.1epss 0.00
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Axiomthemes Racquet allows PHP Local File Inclusion. This issue affects Racquet: from n/a through 1.12.0.
CVE-2025-68886HigJun 2, 2026
WordPress
Cookiteer
risk 0.53cvss 8.1epss 0.00
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in androThemes Cookiteer allows PHP Local File Inclusion. This issue affects Cookiteer: from n/a through 1.4.8.