What is the CVSS score of CVE-2025-54015?

CVE-2025-54015 has a CVSS 3.1 base score of 6.6 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

PHP CVE-2025-54015

MEDIUM

PHP Remote File Inclusion (CWE-98)

2025-07-16 audit@patchstack.com

Information Disclosure PHP LFI

6.6

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.6 MEDIUM

AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVSS changed

Apr 23, 2026 - 15:42 NVD

6.6 (MEDIUM)

Analysis Generated

Apr 01, 2026 - 17:43 vuln.today

CVE Published

Jul 16, 2025 - 11:15 nvd

N/A

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in HT Plugins HT Contact Form 7 ht-contactform allows PHP Local File Inclusion.This issue affects HT Contact Form 7: from n/a through <= 2.0.0.

AnalysisAI

Local file inclusion vulnerability in HT Contact Form 7 plugin version 2.0.0 and earlier allows unauthenticated attackers to read arbitrary files from the server filesystem, potentially exposing sensitive configuration files, credentials, and source code. The vulnerability exists in PHP file inclusion/require statements that fail to properly validate or sanitize user-supplied input, enabling attackers to traverse the directory structure and access files outside the intended directory scope. With an EPSS score of 0.14% indicating low exploitation probability despite the technical capability, this vulnerability requires direct web interaction but poses information disclosure risks rather than remote code execution.

Technical ContextAI

This vulnerability exploits improper input validation in PHP's include() or require() language constructs, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The HT Contact Form 7 WordPress plugin fails to adequately sanitize user-controllable input before passing it to file inclusion functions, allowing attackers to use directory traversal sequences (such as ../ or absolute paths) to access files outside the plugin's intended directory. The affected component processes user input (likely from GET/POST parameters or form submissions) without whitelisting allowed files or implementing proper path canonicalization, creating a local file inclusion (LFI) condition. WordPress plugins are particularly exposed to this attack vector because they operate within the web-accessible directory structure, and the plugin's contact form functionality suggests it accepts user-supplied parameters that reach vulnerable code paths.

Affected ProductsAI

HT Contact Form 7 WordPress plugin versions from initial release through 2.0.0 are affected. The plugin is distributed through the official WordPress plugin repository and is identifiable by slug 'ht-contactform'. Organizations using any version of HT Contact Form 7 up to and including version 2.0.0 should apply updates immediately. No specific CPE identifier was provided in the intelligence data, but the vulnerability affects the WordPress plugin ecosystem and impacts web applications leveraging this contact form solution for user submissions.

RemediationAI

Immediately upgrade HT Contact Form 7 to a version newer than 2.0.0 released by HT Plugins after the vulnerability disclosure. Update the plugin through the WordPress admin dashboard (Plugins > Installed Plugins > HT Contact Form 7 > Update) or via command line (wp plugin update ht-contactform if using WP-CLI). After upgrading, verify the plugin version in the WordPress plugin listing to confirm successful installation. If a newer patched version is not yet available, disable or remove the HT Contact Form 7 plugin entirely until the vendor releases a fix. Refer to the security advisory at https://patchstack.com/database/Wordpress/Plugin/ht-contactform/vulnerability/wordpress-ht-contact-form-7-plugin-2-0-0-local-file-inclusion-vulnerability for detailed patch release information and timeline. Additionally, review server access logs and web application firewall (WAF) logs for potential exploitation attempts using path traversal patterns (../ or ../../) targeting sensitive files like wp-config.php.