What is the CVSS score of CVE-2025-68877?

CVE-2025-68877 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

PHP CVE-2025-68877

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-29 audit@patchstack.com

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

7.5 (HIGH)

Analysis Generated

Apr 01, 2026 - 17:44 vuln.today

CVE Published

Dec 29, 2025 - 16:15 nvd

N/A

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in cedcommerce CedCommerce Integration for Good Market ced-good-market-integration allows PHP Local File Inclusion.This issue affects CedCommerce Integration for Good Market: from n/a through <= 1.0.6.

AnalysisAI

Local file inclusion in CedCommerce Integration for Good Market WordPress plugin versions 1.0.6 and earlier allows unauthenticated attackers to read arbitrary files from the server via improper filename validation in PHP include/require statements. The vulnerability affects a popular e-commerce integration plugin used by WooCommerce merchants, exposing sensitive configuration files, database credentials, and other sensitive data accessible to the web server process. EPSS probability of 0.14% suggests low real-world exploitation likelihood despite the information disclosure impact.

Technical ContextAI

CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) represents a class of PHP vulnerabilities where user-supplied input is passed unsanitized to include(), require(), include_once(), or require_once() functions. In this case, the CedCommerce Integration for Good Market plugin fails to properly validate or sanitize filename parameters before using them in PHP file inclusion operations, enabling local file inclusion (LFI). While the CVE title mentions 'PHP Remote File Inclusion,' the actual vulnerability is local file inclusion, allowing attackers to traverse the filesystem and access files like wp-config.php, .env files, or system configuration files. The vulnerability affects the ced-good-market-integration WordPress plugin, which provides WooCommerce integration functionality for the Good Market e-commerce platform.

Affected ProductsAI

CedCommerce Integration for Good Market (ced-good-market-integration) WordPress plugin from version 1.0.0 through version 1.0.6 is affected. This plugin is distributed via the WordPress plugin repository and is used to integrate WooCommerce stores with the Good Market e-commerce platform. The vulnerability impacts all installations of this plugin at version 1.0.6 and earlier.

RemediationAI

Update CedCommerce Integration for Good Market plugin to a patched version beyond 1.0.6 immediately. Site administrators should log into WordPress dashboard, navigate to Plugins, and update the ced-good-market-integration plugin to the latest available version. If a patched version is not yet available, deactivate and remove the plugin until an update is released. As a temporary workaround prior to patching, restrict access to the plugin's vulnerable endpoints via web server configuration (nginx/Apache) or WordPress security plugins if specific vulnerable URI patterns can be identified. Verify wp-config.php and .env file permissions are restricted to prevent information disclosure if the server has been compromised. See Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/ced-good-market-integration/vulnerability/wordpress-cedcommerce-integration-for-good-market-plugin-1-0-6-local-file-inclusion-vulnerability for additional details and patch version when available.