What is the CVSS score of CVE-2025-26916?

CVE-2025-26916 has a CVSS 3.1 base score of 9.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.3%.

Which versions of PHP are affected by CVE-2025-26916?

CVE-2025-26916 presents critical security risk rated CVSS 9.0. Successful exploitation could critically impact the confidentiality, integrity, and availability of affected systems.

How to fix or mitigate CVE-2025-26916?

Within 24 hours: Identify all affected systems and apply vendor patches immediately. Monitor vendor channels for patch availability.

PHP CVE-2025-26916

CRITICAL

PHP Remote File Inclusion (CWE-98)

2025-03-10 audit@patchstack.com

PHP LFI Information Disclosure

9.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

9.0 CRITICAL

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 19:50 vuln.today

CVE Published

Mar 10, 2025 - 15:15 nvd

CRITICAL 9.0

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in EPC Massive Dynamic. This issue affects Massive Dynamic: from n/a through 8.2.

AnalysisAI

The Massive Dynamic WordPress theme (through 8.2) by EPC is vulnerable to PHP Remote File Inclusion via an improperly controlled include/require statement. Although the attack complexity is high, successful exploitation allows unauthenticated remote code execution with scope change.

Technical ContextAI

The theme fails to properly validate user-controlled input used in PHP include/require statements (CWE-98). An attacker can supply a URL to a remote PHP file, causing the server to fetch and execute it. The 'Changed' scope in the CVSS vector indicates the attacker can break out of the vulnerable component to affect other resources.

Affected ProductsAI

EPC Massive Dynamic WordPress theme through 8.2

RemediationAI

Update Massive Dynamic to a version above 8.2 when available. Disable allow_url_include in php.ini as defense-in-depth. Use a WAF to block RFI patterns.