CWE-98

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')

VariantDraftLikelihood: High

Description

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

In certain versions and configurations of PHP, this can allow an attacker to specify a URL to a remote location from which the product will obtain the code to execute. In other cases in association with path traversal, the attacker can specify a local file that may contain executable statements that can be parsed by PHP.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-193

CVEs mapped to this weakness (1,304)

page 8 of 66

CVE	Vendor / Product	Sev	Risk	CVSS	Published	Description
CVE-2026-39549	WordPress Aperitif	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.
CVE-2026-39547	WordPress Getaway	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Getaway < 1.8 versions.
CVE-2026-39537	WordPress Mikado Core	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions.
CVE-2026-39522	WordPress Solene Core	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Solene <= 3.4 versions.
CVE-2026-34895	WordPress Softlab Core	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions.
CVE-2026-34894	WordPress integrio-core	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions.
CVE-2026-34893	WordPress Thegov Core	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions.
CVE-2026-22338	WordPress EcoBlue	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions.
CVE-2026-22331	WordPress AutoParts	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions.
CVE-2026-22330	WordPress Right Way	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Right Way <= 4.0 versions.
CVE-2026-22326	WordPress Reprizo	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions.
CVE-2026-22325	WordPress Promo	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions.
CVE-2025-69178	WordPress Truemag	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions.
CVE-2025-69177	WordPress Roneous	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions.
CVE-2025-69176	WordPress ITactics	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in ITactics <= 1.0 versions.
CVE-2025-69173	WordPress Tipsy	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.
CVE-2025-69172	WordPress Resurs	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Resurs <= 1.3 versions.
CVE-2025-69171	WordPress Orpheus	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.
CVE-2025-69168	WordPress Spike	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Spike <= 1.2 versions.
CVE-2025-69167	WordPress Eros	Hig	0.53	8.1	Jun 17, 2026	Unauthenticated Local File Inclusion in Eros <= 1.3 versions.

CVE-2026-39549HigJun 17, 2026
WordPress
Aperitif
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Aperitif <= 1.5 versions.
CVE-2026-39547HigJun 17, 2026
WordPress
Getaway
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Getaway < 1.8 versions.
CVE-2026-39537HigJun 17, 2026
WordPress
Mikado Core
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Mikado Core <= 1.6 versions.
CVE-2026-39522HigJun 17, 2026
WordPress
Solene Core
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Solene <= 3.4 versions.
CVE-2026-34895HigJun 17, 2026
WordPress
Softlab Core
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Softlab Core < 1.2.11 versions.
CVE-2026-34894HigJun 17, 2026
WordPress
integrio-core
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Integrio Core < 1.2.8 versions.
CVE-2026-34893HigJun 17, 2026
WordPress
Thegov Core
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Thegov Core < 2.0.23 versions.
CVE-2026-22338HigJun 17, 2026
WordPress
EcoBlue
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in EcoBlue <= 1.15 versions.
CVE-2026-22331HigJun 17, 2026
WordPress
AutoParts
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in AutoParts <= 1.5.8 versions.
CVE-2026-22330HigJun 17, 2026
WordPress
Right Way
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Right Way <= 4.0 versions.
CVE-2026-22326HigJun 17, 2026
WordPress
Reprizo
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Reprizo <= 1.0.8 versions.
CVE-2026-22325HigJun 17, 2026
WordPress
Promo
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Promo <= 1.3.0 versions.
CVE-2025-69178HigJun 17, 2026
WordPress
Truemag
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Truemag <= 4.3.14.2 versions.
CVE-2025-69177HigJun 17, 2026
WordPress
Roneous
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Roneous <= 2.1.5 versions.
CVE-2025-69176HigJun 17, 2026
WordPress
ITactics
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in ITactics <= 1.0 versions.
CVE-2025-69173HigJun 17, 2026
WordPress
Tipsy
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Tipsy <= 1.1 versions.
CVE-2025-69172HigJun 17, 2026
WordPress
Resurs
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Resurs <= 1.3 versions.
CVE-2025-69171HigJun 17, 2026
WordPress
Orpheus
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Orpheus <= 1.3 versions.
CVE-2025-69168HigJun 17, 2026
WordPress
Spike
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Spike <= 1.2 versions.
CVE-2025-69167HigJun 17, 2026
WordPress
Eros
risk 0.53cvss 8.1epss 0.00
Unauthenticated Local File Inclusion in Eros <= 1.3 versions.