CVE-2025-22364
Published: 07 January 2025
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Service Shogun Ach Invoice App ach-invoice-app allows PHP Local File Inclusion.This issue affects Ach Invoice App: from n/a through <= 1.0.1.
Security Summary
CVE-2025-22364 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, known as PHP Remote File Inclusion, that allows PHP Local File Inclusion (CWE-98) in the Service Shogun Ach Invoice App (ach-invoice-app) WordPress plugin. This issue affects all versions from n/a through 1.0.1. The vulnerability was published on 2025-01-07.
The vulnerability carries a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating it is exploitable over the network by unauthenticated attackers with no privileges required, though it involves high attack complexity and user interaction. Successful exploitation enables high-impact effects on confidentiality, integrity, and availability, such as unauthorized access to local files on the server.
Details on mitigation are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ach-invoice-app/vulnerability/wordpress-ach-invoice-app-plugin-1-0-1-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)