What is the CVSS score of CVE-2025-68870?

CVE-2025-68870 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

PHP CVE-2025-68870

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-29 audit@patchstack.com

Information Disclosure PHP LFI

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.5 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 29, 2025 - 17:15 nvd

N/A

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in reDim GmbH CookieHint WP cookiehint-wp allows PHP Local File Inclusion.This issue affects CookieHint WP: from n/a through <= 1.0.0.

AnalysisAI

Local file inclusion in reDim GmbH CookieHint WP plugin versions up to 1.0.0 allows unauthenticated attackers to read arbitrary files from the server filesystem through improper handling of filename parameters in PHP include/require statements. The vulnerability enables information disclosure by permitting attackers to access sensitive configuration files, source code, and other locally stored data without authentication. EPSS score of 0.14% indicates relatively low exploitation probability at time of analysis, and no public exploit code or active exploitation has been confirmed.

Technical ContextAI

The vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP weakness where user-supplied input is directly used in include(), require(), include_once(), or require_once() functions without proper validation or sanitization. The CookieHint WP plugin (CPE data not provided in intelligence, but identified as WordPress plugin from reDim GmbH) fails to restrict file paths before including them, allowing attackers to traverse the filesystem using directory traversal sequences (e.g., ../) or absolute paths to access files outside the intended directory structure. This is distinct from remote file inclusion (RFI) since it is limited to local filesystem access, but equally dangerous for information disclosure attacks.

Affected ProductsAI

reDim GmbH CookieHint WP WordPress plugin versions from an unspecified baseline through version 1.0.0 inclusive. The plugin is distributed via the WordPress plugin repository and affects all installations of this plugin at version 1.0.0 or earlier. Specific CPE string not provided in intelligence, but the plugin is identified as a WordPress plugin and can be referenced as wordpress/cookiehint-wp.

RemediationAI

The primary remediation is to update the CookieHint WP plugin immediately to a patched version released after 1.0.0. Organizations running CookieHint WP must verify plugin updates are available from the WordPress plugin repository or reDim GmbH's official channels and apply them as soon as possible. If patched versions are not immediately available, consider disabling or removing the CookieHint WP plugin until a fix is released. Implement web application firewalls (WAF) rules to detect and block common local file inclusion patterns such as directory traversal sequences (../) and protocol wrappers (php://, file://) in request parameters to the affected plugin until patching is complete. Review access logs for signs of exploitation attempts targeting the plugin's vulnerable functionality. Reference: Patchstack database entry at https://patchstack.com/database/Wordpress/Plugin/cookiehint-wp/vulnerability/wordpress-cookiehint-wp-plugin-1-0-0-local-file-inclusion-vulnerability for detailed technical information and patching guidance.