Edge CPT CVE-2025-62868

Requires a WordPress site running the Edge-Themes Edge CPT plugin at version 1.4 or earlier, reachable over the network. Per PR:N the base flaw needs no authentication, but the AC:H rating and CWE-98 nature mean reliable code execution (as opposed to file disclosure) depends on the attacker being able to control or poison an includable file on the host (e.g., log files, session files, or uploaded content) to be interpreted as PHP; pure file-read disclosure has the lowest barrier. No user interaction is required.

The vendor CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, 8.1 High) describes an unauthenticated, network-reachable PHP file-inclusion flaw with full CIA impact but elevated attack complexity (AC:H). The AC:H is credible for CWE-98 LFI: reading arbitrary local files is straightforward, but escalating to code execution (which the I:H/A:H impacts assume) requires an additional condition such as an attacker-poisonable file (log poisoning, session file, or uploaded content) to include as PHP - so the full-impact scoring is somewhat optimistic and the realistic worst case for a pure LFI is often high-confidentiality file disclosure. EPSS is 0.47% (38th percentile) - modest, consistent with a niche WordPress plugin. There is no CISA KEV listing and no public exploit code identified, so this is not confirmed to be under active exploitation. Net: a genuinely serious flaw class (unauthenticated LFI) but tempered by AC:H, low deployment footprint, and no exploitation signal - a patch-in-normal-cycle item rather than an emergency, unless the plugin is exposed on a high-value site. Note: the input tag 'Information Disclosure' understates the flaw, which per CVSS also carries integrity and availability impact.

A remote unauthenticated attacker sends a crafted request to a vulnerable Edge CPT endpoint that passes attacker-influenced input into a PHP include/require, causing the plugin to include a local file. In the read-only case this leaks sensitive files (e.g., wp-config.php credentials); if the attacker can first plant PHP into an includable file (log/session/upload poisoning), the same inclusion yields remote code execution. No public proof-of-concept is currently identified, and the AC:H rating reflects the extra setup required for reliable code execution.