CWE-98: PHP Remote File Inclusion

The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions.

1,257 tracked CVEs are classified under this weakness.

Highest-risk vulnerabilities

• CVE-2024-27971 — WordPress Premmerce Permalink Manager for WooCommerce plugin <= 2.3.10 - Local File Inclusion vulnerability
• CVE-2024-32523 — WordPress Mailster plugin <= 4.0.6 - Unauthenticated Local File Inclusion vulnerability
• CVE-2025-32614 — WordPress EventON plugin <= 2.4 - Local File Inclusion vulnerability
• CVE-2025-31340 — Wisdom Master Pro - Improper Control of Filename for Include/Require Statement in PHP Program
• CVE-2026-3826 — WellChoose｜IFTOP - Local File Inclusion
• CVE-2026-0926 — Prodigy Commerce <= 3.2.9 - Unauthenticated Local File Inclusion via parameters[template_name]
• CVE-2025-8913 — WellChoose｜Organization Portal System - Local File Inclusion
• CVE-2025-7721 — JoomSport <= 5.7.3 - Unauthenticated Directory Traversal to Local File Inclusion
• CVE-2025-48293 — WordPress Geo Mashup plugin <= 1.13.16 - Local File Inclusion vulnerability
• CVE-2025-4689 — Ads Pro Plugin - Multi-Purpose WordPress Advertising Manager <= 4.89 - Unauthenticated Local File Inclusion to Remote Code Execution
• CVE-2025-46468 — WordPress Fable Extra <= 1.0.6 - Local File Inclusion Vulnerability
• CVE-2025-41734 — Unauthenticated Local File Inclusion in php module
• CVE-2025-39406 — WordPress WPAMS plugin <= 44.0 - Local File Inclusion to Privilege Escalation vulnerability
• CVE-2025-32577 — WordPress Build App Online Plugin <= 1.0.23 - Local File Inclusion vulnerability
• CVE-2024-41925 — Optigo Networks ONS-S8 Spectra Aggregation Switch PHP Remote File Inclusion
• CVE-2024-43261 — WordPress Compute Links plugin <= 1.2.1 - Remote File Inclusion vulnerability
• CVE-2024-36415 — SuiteCRM Improper Control of Filename for Include Statement in PHP and Unrestricted Upload of File with Dangerous content leads to authenticated remote code execution
• CVE-2024-1600 — Local File Inclusion in parisneo/lollms-webui
• CVE-2025-0632 — Local File Inclusion (LFI) leading to sensitive data exposure
• CVE-2026-25548 — InvoicePlane Vulnerable to Remote Code Execution via Local File Inclusion and Log Poisoning

Recently published

• CVE-2026-87927 — MaxSite CMS through 109.6 Local File Inclusion via ajax dispatcher
• CVE-2026-15667 — Eventin <= 4.1.22 - Authenticated (Contirbutor+) Local File Inclusion via 'event_layout' Parameter
• CVE-2026-15406 — Eventin <= 4.1.22 - Authenticated (Custom+) Local File Inclusion via 'event_layout' Parameter
• CVE-2026-11613 — Divi Ajax Filter <= 5.1.2 - Unauthenticated Local File Inclusion via 'custom_loop_template' Parameter
• CVE-2026-78566 — The Shuffle theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.8. This ma
• CVE-2026-78562 — The Verdure Core plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.2. T
• CVE-2026-78478 — Måne <= 1.7 - Unauthenticated Local File Inclusion
• CVE-2026-14280 — Events Manager <= 7.3.7.4 - Authenticated (Administrator+) Local File Inclusion via 'dbem_data[updates]' Array Keys
• CVE-2026-32560 — WordPress MagicAI for WordPress - AI Text, Image, Chat, Code, and Voice Generator plugin <= 1.4 - Local File Inclusion vulnerability
• CVE-2026-66670 — WordPress Måne theme <= 1.7 - Local File Inclusion vulnerability
• CVE-2026-66587 — WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
• CVE-2026-28152 — WordPress Tonda Core plugin < 2.6 - Local File Inclusion vulnerability
• CVE-2026-28151 — WordPress Tonda theme < 2.6 - Local File Inclusion vulnerability
• CVE-2026-66671 — WordPress Verdure Core plugin <= 1.2 - Local File Inclusion vulnerability
• CVE-2026-66586 — WordPress WP Cafe Pro plugin < 3.0.15 - Local File Inclusion vulnerability
• CVE-2026-28150 — WordPress Golo Framework plugin < 1.7.5 - Local File Inclusion vulnerability
• CVE-2025-15637 — WordPress Shuffle theme <= 1.8 - Local File Inclusion vulnerability
• CVE-2026-75963 — Events Made Easy <= 3.2.5 - Authenticated (Contributor+) Local File Inclusion via 'wp_page_template' Event Property
• CVE-2026-73387 — WordPress Resido theme <= 1.5 - Local File Inclusion vulnerability
• CVE-2026-73400 — WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Local File Inclusion vulnerability

Browse the full CVE database