What is the CVSS score of CVE-2023-25995?

CVE-2023-25995 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of PHP are affected by CVE-2023-25995?

A high-severity PHP Local File Inclusion vulnerability exists in the AI Mortgage Calculator plugin (versions through 1.0.1) that could allow attackers to access sensitive files on affected systems.

How to fix or mitigate CVE-2023-25995?

Within 24 hours: Identify all systems running AI Mortgage Calculator and assess customer impact; disable the plugin if not critical to operations. Within 7 days: Implement WAF rules to block malicious file inclusion attempts and restrict plugin access to authorized users only; evaluate alternative mortgage calculator solutions. Within 30 days: Contact vendor for patch timeline; if unavailable, plan plugin removal and migration to patched alternative solution.

PHP CVE-2023-25995

EUVD-2023-29882 HIGH

PHP Remote File Inclusion (CWE-98)

2025-06-06 audit@patchstack.com

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:23 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 18:10 euvd

EUVD-2023-29882

Analysis Generated

Mar 14, 2026 - 18:10 vuln.today

CVE Published

Jun 06, 2025 - 13:15 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in choicehomemortgage AI Mortgage Calculator allows PHP Local File Inclusion. This issue affects AI Mortgage Calculator: from n/a through 1.0.1.

AnalysisAI

PHP Local File Inclusion (LFI) vulnerability in choicehomemortgage AI Mortgage Calculator versions up to 1.0.1, caused by improper input validation on file inclusion statements. An authenticated attacker with low privileges can exploit this vulnerability over the network to read arbitrary files from the server, potentially leading to information disclosure, privilege escalation, or remote code execution. The high CVSS score of 7.5 reflects the severity of potential impacts (confidentiality, integrity, availability compromise), though the requirement for authenticated access and high attack complexity somewhat limit real-world exploitability.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP security flaw where user-controlled input is passed directly to include(), require(), include_once(), or require_once() functions without proper validation or sanitization. The AI Mortgage Calculator plugin fails to adequately filter or whitelist filenames before including them, allowing attackers to traverse the filesystem and include arbitrary local files (LFI, not RFI despite the description mentioning RFI). In PHP environments, this can lead to disclosure of sensitive files (configuration files containing database credentials, /etc/passwd on Linux systems, application source code) or, in specific conditions with log poisoning or file upload chains, potential code execution. The affected product is choicehomemortgage AI Mortgage Calculator (CPE context suggests WordPress plugin distribution), versions from unspecified baseline through 1.0.1.