What is the CVSS score of CVE-2025-62753?

CVE-2025-62753 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.2%.

PHP CVE-2025-62753

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-30 audit@patchstack.com

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.5 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 30, 2025 - 23:15 nvd

N/A

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in MadrasThemes MAS Videos masvideos allows PHP Local File Inclusion.This issue affects MAS Videos: from n/a through <= 1.3.4.

AnalysisAI

Local file inclusion vulnerability in MadrasThemes MAS Videos WordPress plugin versions up to 1.3.4 allows unauthenticated attackers to read arbitrary files from the affected server through improper control of filename parameters in PHP include/require statements. The vulnerability affects the masvideos plugin and has been tracked by Patchstack with an EPSS score of 0.17% (38th percentile), indicating low exploitation probability despite the presence of information disclosure risk.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP Local File Inclusion (LFI) flaw. The MAS Videos plugin fails to properly sanitize or validate user-supplied input before passing it to PHP include() or require() functions. Attackers can manipulate filename parameters to traverse directory paths (e.g., using ../ sequences or absolute paths) and include arbitrary files from the server filesystem, potentially reading sensitive configuration files, source code, or system files. The plugin architecture in WordPress context means this affects any site running the vulnerable masvideos plugin through version 1.3.4.

Affected ProductsAI

MadrasThemes MAS Videos WordPress plugin versions from an unspecified baseline through 1.3.4 inclusive are affected. The plugin is identified by CPE reference to masvideos and is distributed via the WordPress plugin ecosystem. Detailed version ranges and exact CPE designation should be confirmed via the Patchstack vulnerability database and WordPress.org plugin repository.

RemediationAI

Update the MAS Videos plugin immediately to the patched version released after 1.3.4. Patchstack has published a vulnerability advisory at https://patchstack.com/database/Wordpress/Plugin/masvideos/vulnerability/wordpress-mas-videos-plugin-1-3-2-local-file-inclusion-vulnerability?_s_id=cve which includes the fixed version number and detailed remediation guidance. If an immediate update is not possible, disable the plugin and review access logs for evidence of exploitation targeting file inclusion parameters. Web application firewall rules should be deployed to block requests containing directory traversal sequences (../, absolute paths) in parameters known to be vulnerable.