What is the CVSS score of CVE-2025-62075?

CVE-2025-62075 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.0%.

Which versions of Simple Payment are affected by CVE-2025-62075?

The Simple Payment WordPress plugin (versions ≤2.4.6) contains a local file inclusion vulnerability that could allow remote attackers to access and execute arbitrary files on affected servers.

How to fix or mitigate CVE-2025-62075?

Within 24 hours: inventory all WordPress installations using Simple Payment plugin and identify current versions. Within 7 days: upgrade all instances to version 2.4.7 or later if available; if no patched version exists, disable and remove the plugin entirely. Within 30 days: implement Web Application Firewall (WAF) rules to detect local file inclusion attempts and audit server logs for suspicious file access patterns during the upgrade window.

Simple Payment CVE-2025-62075

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:21 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.3 (HIGH) 7.5 (HIGH)

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 7.3

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Ido Kobelkowsky Simple Payment simple-payment.This issue affects Simple Payment: from n/a through <= 2.4.6.

AnalysisAI

Local File Inclusion (LFI) in Simple Payment WordPress plugin versions ≤2.4.6 allows remote attackers to include and execute arbitrary local files via PHP file inclusion flaws. Attack requires high complexity (AC:H) and user interaction (UI:R), suggesting exploitation depends on specific conditions like attacker-controllable parameters combined with victim action. EPSS score of 0.04% (13th percentile) indicates low observed exploitation probability in the wild. No CISA KEV listing or public exploit code identified at time of analysis, limiting immediate threat surface despite 7.5 CVSS score.

Technical ContextAI

The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), a classic PHP security issue where user-controlled input influences file paths used in include() or require() statements without proper sanitization. While the CVE title references 'PHP Remote File Inclusion', the Patchstack reference and tags consistently identify this as Local File Inclusion (LFI). In WordPress plugins, LFI typically occurs when plugins process user input (query parameters, POST data, cookies) to dynamically construct file paths for template loading or module inclusion. Successful exploitation allows reading sensitive files (/etc/passwd, wp-config.php) or executing PHP code if the attacker can upload a file containing PHP payloads or leverage existing writable files with predictable paths.

Affected ProductsAI

WordPress plugin 'Simple Payment' (simple-payment) developed by Ido Kobelkowsky, affecting all versions from inception through version 2.4.6 inclusive. The vulnerability database entry at Patchstack (https://patchstack.com/database/Wordpress/Plugin/simple-payment/vulnerability/wordpress-simple-payment-plugin-2-4-6-local-file-inclusion-vulnerability) serves as the primary vendor advisory. No CPE strings provided in available data. WordPress sites running Simple Payment plugin version 2.4.6 or earlier should consider themselves affected until vendor confirmation of fix version.

RemediationAI

Upgrade Simple Payment plugin to version 2.4.7 or later if available, verifying the changelog addresses file inclusion vulnerabilities. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/simple-payment/vulnerability/wordpress-simple-payment-plugin-2-4-6-local-file-inclusion-vulnerability for vendor-confirmed fix version and upgrade instructions. If no patched version exists or immediate upgrade is not feasible, implement compensating controls: (1) Disable the Simple Payment plugin entirely if not actively required for business operations - eliminates attack surface but breaks payment functionality; (2) Restrict plugin access to authenticated administrator users only via WordPress role management - reduces UI:R attack surface but limits legitimate use cases; (3) Deploy Web Application Firewall (WAF) rules blocking requests with directory traversal patterns (../, %2e%2e%2f, absolute paths) to plugin endpoints - may cause false positives for legitimate file upload features; (4) Enable PHP open_basedir restrictions in php.ini to limit file system access scope - requires server-level configuration and may impact other WordPress functionality. Monitor WordPress and plugin error logs for suspicious file path requests as detection mechanism.