Cyber Posture

CVE-2025-26932

High

Published: 25 February 2025

Published
25 February 2025
Modified
23 April 2026
KEV Added
—
Patch
—
CVSS Score 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0061 69.8th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-26932 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion, in the QuantumCloud ChatBot WordPress plugin. It enables PHP Local File Inclusion and affects all versions up to and including 6.3.5.

The vulnerability has a CVSS v3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). An attacker with low privileges can exploit it over the network, requiring high attack complexity but no user interaction. Successful exploitation grants high impacts on confidentiality, integrity, and availability.

Mitigation details are available in the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/chatbot/vulnerability/wordpress-wpbot-plugin-6-3-5-local-file-inclusion-vulnerability?_s_id=cve.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The CVE describes a network-exploitable vulnerability (AV:N) in a public-facing WordPress plugin allowing local/remote file inclusion with high impact, directly enabling initial access via exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References