What is the CVSS score of CVE-2025-27264?

CVE-2025-27264 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

Which versions of Doctor Appointment Booking are affected by CVE-2025-27264?

The Doctor Appointment Booking WordPress plugin (version 1.0.0 and earlier) contains a local file inclusion vulnerability that allows authenticated users with low privileges to access sensitive…

How to fix or mitigate CVE-2025-27264?

Within 24 hours: Identify all WordPress installations using Doctor Appointment Booking plugin and document current version numbers; disable or remove the plugin if business-critical functionality permits. Within 7 days: Contact plugin vendor for patch timeline and security guidance; implement file access restrictions via web server configuration (.htaccess or Nginx rules) to limit access to sensitive directories (/wp-config.php, wp-content/uploads/). Within 30 days: Upgrade to patched version upon vendor release; audit server logs for unauthorized file access attempts (HTTP 200 responses to suspicious paths); rotate all credentials exposed in configuration files.

Doctor Appointment Booking CVE-2025-27264

HIGH

PHP Remote File Inclusion (CWE-98)

2025-03-03 audit@patchstack.com

Information Disclosure LFI PHP

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 25, 2026 - 00:54 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 18:29 vuln.today

CVE Published

Mar 03, 2025 - 14:15 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in NotFound Doctor Appointment Booking allows PHP Local File Inclusion. This issue affects Doctor Appointment Booking: from n/a through 1.0.0.

AnalysisAI

Local File Inclusion (LFI) in Doctor Appointment Booking WordPress plugin version 1.0.0 and earlier allows authenticated attackers with low privileges to read arbitrary files from the server filesystem, potentially exposing configuration files, credentials, and sensitive application data. Despite the network attack vector, exploitation requires high complexity conditions and low-level authentication. EPSS score of 0.24% (47th percentile) suggests low probability of widespread exploitation, with no CISA KEV listing or confirmed active exploitation at time of analysis.

Technical ContextAI

This vulnerability stems from improper validation of file paths in PHP include/require statements (CWE-98). The plugin fails to sanitize user-controlled input used to construct file paths, allowing attackers to traverse directory structures using path traversal sequences (e.g., '../../../') or null byte injection. While classified as 'PHP Remote File Inclusion' in the description, Patchstack tags and NVD references consistently identify this as Local File Inclusion, meaning attackers can only access files already present on the server filesystem, not inject remote code. The vulnerability affects the Doctor Appointment Booking WordPress plugin, a medical scheduling application, through version 1.0.0. The AC:H (high complexity) metric suggests exploitation requires specific timing, configuration states, or race condition wins beyond simple parameter manipulation.

Affected ProductsAI

WordPress Doctor Appointment Booking plugin versions 1.0.0 and all prior versions are confirmed vulnerable per Patchstack database advisory. The affected version range begins at an unspecified early version (marked 'n/a' in NVD data) through the currently documented version 1.0.0. Site administrators can verify installed version through WordPress admin dashboard under Plugins section. Full vendor advisory and technical details available at Patchstack database reference URL: https://patchstack.com/database/wordpress/plugin/doctor-appointment-booking/vulnerability/wordpress-doctor-appointment-booking-plugin-1-0-0-local-file-inclusion-vulnerability

RemediationAI

No vendor-released patched version has been identified in available data sources at time of analysis. Site administrators should immediately check the WordPress plugin repository and plugin vendor website for updates beyond version 1.0.0 that address CVE-2025-27264. Until a confirmed patch is available, implement these compensating controls: (1) Restrict WordPress user role assignments to Subscriber level and below only for untrusted users, as the vulnerability requires PR:L authentication - note this may impact legitimate appointment booking workflows if Contributors need elevated access; (2) Deploy Web Application Firewall rules blocking path traversal patterns in HTTP parameters (sequences like '../', encoded variants '%2e%2e%2f', null bytes '%00') targeting the plugin's endpoints - creates false positive risk for legitimate file operations; (3) Enable PHP open_basedir restrictions in php.ini limiting file access to WordPress installation directory only - may break plugins relying on system-wide file access; (4) Monitor server logs for suspicious file access patterns to /etc/passwd, wp-config.php, or .env files originating from plugin processes. Consult Patchstack advisory at https://patchstack.com/database/wordpress/plugin/doctor-appointment-booking/ for vendor patch announcements and additional technical guidance.