{"id":"CVE-2025-26933","aliases":["EUVD-2025-7720","GHSA-x6h9-j33j-2wpw"],"status":"published","title":"WordPress Place Order Without Payment for WooCommerce plugin \u003c= 2.6.7 - Local File Inclusion vulnerability","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nitin Prakash WC Place Order Without Payment wc-place-order-without-payment allows PHP Local File Inclusion.This issue affects WC Place Order Without Payment: from n/a through \u003c= 2.6.7.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00559,"percentile":0.46909,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-98"],"published":"2025-03-10T14:34:39Z","modified":"2026-06-17T09:02:37Z","products":[{"vendor":"nitin prakash","product":"wc place order without payment"}],"references":[{"url":"https://patchstack.com/database/Wordpress/Plugin/wc-place-order-without-payment/vulnerability/wordpress-place-order-without-payment-for-woocommerce-plugin-2-6-7-local-file-inclusion-vulnerability?_s_id=cve","tags":["vdb-entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-26933"},{"url":"https://patchstack.com/database/wordpress/plugin/wc-place-order-without-payment/vulnerability/wordpress-place-order-without-payment-for-woocommerce-plugin-2-6-7-local-file-inclusion-vulnerability?_s_id=cve"},{"url":"https://github.com/advisories/GHSA-x6h9-j33j-2wpw"}],"sources":{"cve":[{"id":"CVE-2025-26933","title":"WordPress Place Order Without Payment for WooCommerce plugin \u003c= 2.6.7 - Local File Inclusion vulnerability","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nitin Prakash WC Place Order Without Payment wc-place-order-without-payment allows PHP Local File Inclusion.This issue affects WC Place Order Without Payment: from n/a through \u003c= 2.6.7.","status":"published","published":"2025-03-10T14:34:39.12Z","modified":"2026-04-28T16:11:44.332Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:32:28.250136Z"}],"euvd":[{"id":"EUVD-2025-7720","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nitin Prakash WC Place Order Without Payment wc-place-order-without-payment allows PHP Local File Inclusion.This issue affects WC Place Order Without Payment: from n/a through \u003c= 2.6.7.","status":"published","published":"2025-03-10T14:34:39Z","modified":"2026-04-28T16:11:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:05:50.148229Z"}],"ghsa":[{"id":"GHSA-x6h9-j33j-2wpw","title":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File...","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nitin Prakash WC Place Order Without Payment allows PHP Local File Inclusion. This issue affects WC Place Order Without Payment: from n/a through 2.6.7.","status":"published","published":"2025-03-10T15:30:49Z","modified":"2025-03-10T15:30:55Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T15:00:12.026932Z"}],"nvd":[{"id":"CVE-2025-26933","description":"Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Nitin Prakash WC Place Order Without Payment wc-place-order-without-payment allows PHP Local File Inclusion.This issue affects WC Place Order Without Payment: from n/a through \u003c= 2.6.7.","status":"published","published":"2025-03-10T15:15:37.997Z","modified":"2026-06-17T09:02:37.65Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-98"],"updated_at":"2026-11-02T14:10:53.101324Z"}]}}