CVE-2025-62868
Published: 24 October 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-62868 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified under CWE-98 and described as enabling PHP Local File Inclusion, in the Edge-Themes Edge CPT WordPress plugin. This issue affects all versions of Edge CPT from n/a through 1.4. Published on 2025-10-24, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated remote attackers can exploit this vulnerability over the network without user interaction, though exploitation requires high attack complexity. Successful attacks can result in high impacts to confidentiality, integrity, and availability, potentially allowing attackers to include and execute local PHP files.
Patchstack has documented this vulnerability in its database for the Edge CPT WordPress plugin version 1.4, providing details under its security policy and vulnerability disclosure program; practitioners should consult the advisory at https://patchstack.com/database/wordpress/plugin/edge-cpt/security-policy/vdp/vulnerability/wordpress-edge-cpt-plugin-1-4-local-file-inclusion-vulnerability?_s_id=cve for mitigation guidance.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is an LFI in a public-facing WordPress plugin exploitable remotely for RCE and sensitive data disclosure, directly enabling T1190: Exploit Public-Facing Application.