Cyber Posture

CVE-2025-24685

High

Published: 27 January 2025

Published
27 January 2025
Modified
23 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0036 58.3th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-24685 is a path traversal vulnerability utilizing the '.../...//' sequence in the Morkva UA Shipping WordPress plugin (morkva-ua-shipping), enabling PHP Local File Inclusion. This flaw affects all versions of the plugin from n/a through 1.0.18 and is classified under CWE-35 with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).

Unauthenticated attackers can exploit this vulnerability remotely over the network, though it requires high attack complexity and no user interaction. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, permitting inclusion and potential execution of arbitrary local PHP files.

The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/morkva-ua-shipping/vulnerability/wordpress-morkva-ua-shipping-plugin-1-0-18-local-file-inclusion-vulnerability?_s_id=cve) documents the local file inclusion vulnerability in the Morkva UA Shipping WordPress plugin up to version 1.0.18. Practitioners should consult this reference for detailed mitigation guidance, such as applying available patches or updates.

Details

CWE(s)
CWE-35

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

This is a remote unauthenticated vulnerability in a public-facing WordPress plugin that directly enables exploitation of a public-facing application for initial access, with LFI leading to high-impact code execution on the server.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References