CWE-98— PHP Remote File Inclusion

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.— MITRE CWE catalog

1,359 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-98page 6 of 28

CVE-2025-58891HIGHCVSS 8.1EG 8.2
2025-12-18
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Sanger sanger allows PHP Local File Inclusion.This issue affects Sanger: from n/a through <= 1.24.0.
CVE-2025-58890HIGHCVSS 8.1EG 8.2
2025-12-18
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Playful playful allows PHP Local File Inclusion.This issue affects Playful: from n/a through <= 1.19.0.
CVE-2025-58889HIGHCVSS 8.1EG 8.2
2025-12-18
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Towny towny allows PHP Local File Inclusion.This issue affects Towny: from n/a through <= 1.16.
CVE-2025-58888HIGHCVSS 8.1EG 8.2
2025-12-18
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes The Flash theflash allows PHP Local File Inclusion.This issue affects The Flash: from n/a through <= 1.15.
CVE-2025-58885HIGHCVSS 8.1EG 8.2
2025-12-18
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Pathfinder pathfinder allows PHP Local File Inclusion.This issue affects Pathfinder: from n/a through <= …
CVE-2025-58879HIGHCVSS 8.1EG 8.2
2025-12-18
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Festy festy allows PHP Local File Inclusion.This issue affects Festy: from n/a through <= 1.13.0.
CVE-2025-58803HIGHCVSS 8.1EG 8.2
2025-12-18
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Algenix algenix allows PHP Local File Inclusion.This issue affects Algenix: from n/a through <= 1.0.
CVE-2025-53453HIGHCVSS 8.1EG 8.2
2025-12-18
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Hygia hygia allows PHP Local File Inclusion.This issue affects Hygia: from n/a through <= 1.16.
CVE-2025-60199HIGHCVSS 8.1EG 8.2
2025-11-06
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dedalx InHype - Blog & Magazine WordPress Theme inhype allows PHP Local File Inclusion.This issue affects InHype - Blo…
CVE-2025-60198HIGHCVSS 8.1EG 8.2
2025-11-06
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in dedalx Saxon - Viral Content Blog & Magazine Marketing WordPress Theme saxon allows PHP Local File Inclusion.This issu…
CVE-2025-60197HIGHCVSS 8.1EG 8.2
2025-11-06
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in owenr88 Simple Contact Forms simple-contact-forms allows PHP Local File Inclusion.This issue affects Simple Contact Fo…
CVE-2026-112850HIGHCVSS 8.1EG 8.1
2026-10-23
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in AncoraThemes Your Dress your-dress allows PHP Local File Inclusion.This issue affects Your Dress: from n/a through 1.4…
CVE-2026-112820HIGHCVSS 8.1EG 8.1
2026-10-22
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Elated-Themes Academist Core academist-core allows PHP Local File Inclusion.This issue affects Academist Core: from n/…
CVE-2016-20101HIGHCVSS 8.1EG 8.1
2026-10-20
Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated attackers to include remote or local files through the 'abspath' parameter. Attackers can send GET requests to menu/docum…
CVE-2026-104909HIGHCVSS 8.1EG 8.1
2026-10-14
The Mang Board plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.3 via the '<mode>_type (e.g. foo_type)' parameter parameter. This makes it possible for unauthenticated attackers to includ…
CVE-2026-103367HIGHCVSS 8.1EG 8.1
2026-10-14
The ShopMagic – email automation for WordPress plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 4.9.0 via the 'billing_address.first_name' parameter parameter. This makes it possible for un…
CVE-2026-104995HIGHCVSS 8.1EG 8.1
2026-10-14
The BP Profile Search plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 5.9 via the 'ajax_template' value parsed from the client-controlled 'bps_directory' cookie during BuddyPress AJAX directory …
CVE-2026-66566HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in Ambient <= 1.7 versions.
CVE-2026-62115HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in KuteShop <= 4.2.9 versions.
CVE-2026-62099HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in Boutique <= 2.3.3 versions.
CVE-2026-62096HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in Biolife <= 3.2.3 versions.
CVE-2026-62094HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in TechOne <= 3.0.3 versions.
CVE-2026-62092HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in Armania <= 1.4.8 versions.
CVE-2026-62075HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in Backhoe <= 2.0 versions.
CVE-2026-62074HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in Ozeum <= 1.3.0 versions.
CVE-2026-62070HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in Flipmart <= 2.8 versions.
CVE-2026-62069HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in Fabius <= 1.0 versions.
CVE-2026-62068HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in Teoro <= 1.1 versions.
CVE-2026-62067HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in Kaven <= 1.2 versions.
CVE-2026-62066HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in Volos <= 1.2 versions.
CVE-2026-62065HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in Cardea <= 2.3 versions.
CVE-2026-62020HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in TouchUp < 1.4 versions.
CVE-2026-48194HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in DukaMarket <= 1.3.0 versions.
CVE-2026-48193HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in Uminex <= 1.0.9 versions.
CVE-2026-42777HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in Aalto <= 1.8 versions.
CVE-2026-42724HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in CleanSkin <= 1.5.0 versions.
CVE-2026-42704HIGHCVSS 8.1EG 8.1
2026-10-10
Unauthenticated Local File Inclusion in Kids Care <= 3.2.4 versions.
CVE-2026-104899HIGHCVSS 8.1EG 8.1
2026-10-10
The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.8.187 via the 'design_type' parameter parameter. This ma…
CVE-2026-94067HIGHCVSS 8.1EG 8.1
2026-10-09
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes The Voux thevoux-wp allows PHP Local File Inclusion.This issue affects The Voux: from n/a through 6.9.5.
CVE-2026-94062HIGHCVSS 8.1EG 8.1
2026-10-09
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3.
CVE-2026-92969HIGHCVSS 8.1EG 8.1
2026-09-22
The HUSKY – Products Filter for WooCommerce Professional plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.4.4 via the 'shortcode' parameter parameter. This makes it possible for unauthent…
CVE-2026-78478HIGHCVSS 8.1EG 8.1
2026-08-25
The Mane theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.7. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution…
CVE-2026-66670HIGHCVSS 8.1EG 8.1
2026-08-24
Unauthenticated Local File Inclusion in Måne <= 1.7 versions.
CVE-2026-28152HIGHCVSS 8.1EG 8.1
2026-08-24
Unauthenticated Local File Inclusion in Tonda Core < 2.6 versions.
CVE-2026-28151HIGHCVSS 8.1EG 8.1
2026-08-24
Unauthenticated Local File Inclusion in Tonda < 2.6 versions.
CVE-2026-66671HIGHCVSS 8.1EG 8.1
2026-08-24
Unauthenticated Local File Inclusion in Verdure Core <= 1.2 versions.
CVE-2026-28150HIGHCVSS 8.1EG 8.1
2026-08-20
Unauthenticated Local File Inclusion in Golo Framework < 1.7.5 versions.
CVE-2025-15637HIGHCVSS 8.1EG 8.1
2026-08-20
Unauthenticated Local File Inclusion in Shuffle <= 1.8 versions.
CVE-2026-73387HIGHCVSS 8.1EG 8.1
2026-08-19
Unauthenticated Local File Inclusion in Resido <= 1.5 versions.
CVE-2026-73400HIGHCVSS 8.1EG 8.1
2026-08-18
Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.

Map vulnerabilities like CWE-98 to your infrastructure

EchelonGraph correlates every CVE — across CWE-98 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →