What is the CVSS score of CVE-2026-25017?

CVE-2026-25017 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2026-25017?

CVE-2026-25017 presents notable security risk rated CVSS 8.1. Successful exploitation could significantly impact the confidentiality, integrity, or availability of affected systems.

How to fix or mitigate CVE-2026-25017?

Within 7 days: Identify all affected systems and apply vendor patches promptly. Monitor vendor channels for patch availability.

PHP CVE-2026-25017

EUVD-2026-15617 HIGH

PHP Remote File Inclusion (CWE-98)

2026-03-25 Patchstack

GHSA-v44h-w67q-qjc7

PHP Information Disclosure LFI

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 24, 2026 - 16:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 25, 2026 - 16:47 euvd

EUVD-2026-15617

Analysis Generated

Mar 25, 2026 - 16:47 vuln.today

CVE Published

Mar 25, 2026 - 16:14 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in stmcan NaturaLife Extensions naturalife-extensions allows PHP Local File Inclusion.This issue affects NaturaLife Extensions: from n/a through <= 2.1.

AnalysisAI

A Local File Inclusion (LFI) vulnerability exists in the NaturaLife Extensions WordPress plugin (versions up to 2.1) due to improper control of filenames in PHP include/require statements. This vulnerability allows unauthenticated attackers to read arbitrary files from the affected server, potentially leading to sensitive information disclosure such as configuration files, database credentials, and application source code. No CVSS score, EPSS data, or active KEV status is available, but the vulnerability is confirmed by Patchstack and tracked under EUVD-2026-15617.

Technical ContextAI

The vulnerability is rooted in CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a classic PHP remote/local file inclusion flaw. The NaturaLife Extensions plugin (cpe:2.3:a:stmcan:naturalife_extensions:*:*:*:*:*:*:*:*) fails to properly sanitize user-supplied input before passing it to PHP include() or require() functions. This allows attackers to manipulate file paths to access files outside the intended directory structure. Unlike RFI (Remote File Inclusion), LFI in this case is limited to local file system access but can still expose sensitive application and system files. The vulnerability affects all versions of the plugin through version 2.1, with no indication of a patched version being available at the time of reporting.

RemediationAI

Immediately deactivate and remove the NaturaLife Extensions plugin from all affected WordPress installations if a patched version is not available from the vendor. Contact stmcan for patch availability or check for updates through the WordPress plugin directory. If continued use is necessary pending a vendor patch, implement file access controls at the web server level using a Web Application Firewall (WAF) or Apache/.htaccess rules to block requests containing path traversal patterns (../, ..\, etc.). Additionally, restrict direct access to sensitive WordPress configuration files (wp-config.php) and disable PHP execution in upload directories via server configuration. Monitor server logs for exploitation attempts and conduct a file access audit to identify any compromised credentials or exposed files. As a temporary measure, consider moving the plugin to a sandboxed environment or restricting access by IP whitelist until patching is feasible.