What is the CVSS score of CVE-2025-39468?

CVE-2025-39468 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Modal Survey are affected by CVE-2025-39468?

CVE-2025-39468 affects Modal Survey WordPress plugin through version 2.0.2.0.1 and allows unauthenticated attackers to execute arbitrary PHP code on affected WordPress sites through remote file…

How to fix or mitigate CVE-2025-39468?

Within 24 hours: Inventory all WordPress installations using Modal Survey plugin and identify those running version 2.0.2.0.1 or earlier. Within 7 days: Disable or remove the Modal Survey plugin from all affected WordPress sites until a patch is released; if the plugin is business-critical, isolate affected sites behind additional access controls and WAF rules blocking suspicious include/require patterns. Within 30 days: Monitor Patchstack and the plugin vendor's official channels for patch availability and apply immediately upon release; conduct a full audit of affected WordPress instances for signs of compromise.

Modal Survey CVE-2025-39468

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:06 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Severity Changed

Apr 23, 2026 - 15:43 NVD

CRITICAL HIGH

CVSS changed

Apr 23, 2026 - 15:43 NVD

9.8 (CRITICAL) 8.1 (HIGH)

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:15 nvd

CRITICAL 9.8

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in pantherius Modal Survey modal-survey.This issue affects Modal Survey: from n/a through <= 2.0.2.0.1.

AnalysisAI

Remote file inclusion in Modal Survey WordPress plugin through version 2.0.2.0.1 allows unauthenticated attackers to include and execute arbitrary PHP files via manipulated include/require statements. Exploitation requires complex conditions (AC:H) but no authentication, potentially leading to complete site compromise. EPSS score of 0.14% (35th percentile) suggests low probability of mass exploitation. Patchstack security audit identified this vulnerability as exploitable for both remote file inclusion and local file inclusion.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), a classic PHP security flaw where user-controlled input is passed directly to file inclusion functions (include, require, include_once, require_once) without proper validation. Modal Survey is a WordPress plugin developed by pantherius for creating survey modals. The plugin fails to sanitize file path parameters before using them in PHP file inclusion statements, enabling attackers to traverse directories or reference remote URLs. WordPress plugins commonly suffer from this vulnerability class when implementing dynamic template loading, AJAX handlers, or file upload processing without strict allowlisting of permitted file paths. The CVSS vector indicates network-based exploitation (AV:N) with high attack complexity (AC:H), suggesting exploitation requires specific knowledge of file paths, race conditions, or particular plugin configurations.

Affected ProductsAI

WordPress Modal Survey plugin versions through 2.0.2.0.1 developed by pantherius. The vulnerability affects all versions from the initial release up to and including version 2.0.2.0.1. No CPE identifier provided in available data. Patchstack vulnerability database reference: https://patchstack.com/database/Wordpress/Plugin/modal-survey/vulnerability/wordpress-modal-survey-plugin-2-0-2-0-1-local-file-inclusion-vulnerability

RemediationAI

Update Modal Survey plugin to version 2.0.2.0.2 or later if available (verify current patched version at WordPress.org plugin repository or Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/modal-survey/vulnerability/wordpress-modal-survey-plugin-2-0-2-0-1-local-file-inclusion-vulnerability). If no patched version exists, immediately deactivate and remove the Modal Survey plugin until a fix is released. Compensating controls for organizations requiring continued operation: implement Web Application Firewall rules blocking requests with path traversal sequences (../, .%2e, %2e%2e) and null byte injections (%00) to plugin endpoints; restrict plugin directory permissions to prevent writing attacker-controlled files for inclusion; disable allow_url_include in PHP configuration (php.ini) to prevent remote file inclusion while permitting only local file inclusion (reduces exploitability but does not eliminate information disclosure risk). Note that WAF rules may cause false positives if the plugin legitimately processes file paths in surveys. Monitor WordPress access logs for suspicious requests to /wp-content/plugins/modal-survey/ containing unusual file parameters or directory traversal patterns.