What is the CVSS score of CVE-2025-26933?

CVE-2025-26933 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of WC Place Order Without Payment are affected by CVE-2025-26933?

CVE-2025-26933 is a local file inclusion vulnerability in WC Place Order Without Payment WordPress plugin (up to v2.6.7) that allows remote attackers to read arbitrary server files through improper…

How to fix or mitigate CVE-2025-26933?

Within 24 hours: Identify all WordPress instances running WC Place Order Without Payment plugin and document current versions. Within 7 days: Disable or remove the plugin if not actively required for business operations; contact plugin vendor for patch timeline. Within 30 days: Either apply vendor-released patch when available or implement alternative payment workflow solution to replace this plugin entirely.

WC Place Order Without Payment CVE-2025-26933

HIGH

PHP Remote File Inclusion (CWE-98)

2025-03-10 audit@patchstack.com

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 00:49 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 12, 2026 - 19:50 vuln.today

CVE Published

Mar 10, 2025 - 15:15 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nitin Prakash WC Place Order Without Payment allows PHP Local File Inclusion. This issue affects WC Place Order Without Payment: from n/a through 2.6.7.

AnalysisAI

Local File Inclusion in WC Place Order Without Payment (WordPress plugin) versions up to 2.6.7 enables remote attackers to read arbitrary files from the web server through improper filename control in PHP include/require statements. While CVSS rates this 7.5 (High), EPSS exploitation probability is low (0.24%, 46th percentile), and no active exploitation is confirmed (not in CISA KEV). Patchstack vulnerability database confirms the flaw, but no public exploit code is identified at time of analysis. Real-world risk is moderate: exploitation requires high attack complexity and user interaction, limiting mass exploitation scenarios despite network accessibility.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), where the WordPress plugin fails to properly validate or sanitize file paths before passing them to PHP include() or require() functions. Despite the CVE description mentioning 'PHP Remote File Inclusion,' Patchstack tags and technical classification confirm this is actually a Local File Inclusion (LFI) vulnerability. In LFI attacks, malicious input manipulates file path parameters to read sensitive local files like wp-config.php, /etc/passwd, or application source code containing credentials. The WooCommerce integration context suggests the vulnerable code likely exists in order processing workflows where file paths are dynamically constructed based on user-controllable input without proper path traversal protection or whitelist validation.

Affected ProductsAI

WordPress plugin 'WC Place Order Without Payment' (also known as 'Place Order Without Payment for WooCommerce') by developer Nitin Prakash, versions from earliest release through 2.6.7 inclusive. The plugin extends WooCommerce functionality to allow order placement without immediate payment processing. Patchstack advisory available at https://patchstack.com/database/wordpress/plugin/wc-place-order-without-payment/vulnerability/wordpress-place-order-without-payment-for-woocommerce-plugin-2-6-7-local-file-inclusion-vulnerability providing technical details. No CPE identifier provided in available data. Affected installations require both WordPress core and WooCommerce plugin as dependencies.

RemediationAI

Upgrade WC Place Order Without Payment plugin to version 2.6.8 or later if available - verify current version from WordPress.org plugin repository or vendor changelog as Patchstack reference does not explicitly confirm patched version number. Check plugin changelog at https://wordpress.org/plugins/wc-place-order-without-payment/#developers for security updates post-2.6.7. If immediate upgrade unavailable, implement these compensating controls with noted trade-offs: (1) Temporarily disable the WC Place Order Without Payment plugin via WordPress admin dashboard until patch confirmed - this breaks order-without-payment functionality but eliminates attack surface. (2) Restrict plugin access to trusted authenticated users only through WordPress role/capability controls (does not mitigate authenticated attacker scenarios but reduces exposure). (3) Deploy Web Application Firewall (WAF) rules to block requests containing path traversal sequences (../, %2e%2e/, etc.) in parameters passed to plugin endpoints - may cause false positives blocking legitimate file upload/selection features. (4) Enable PHP open_basedir restriction in php.ini to limit file access to WordPress directory tree - may break plugins expecting broader filesystem access. Consult Patchstack advisory for additional vendor-specific guidance.