CVE-2025-39391 is a Local File Inclusion (LFI) vulnerability affecting the Checkout Field Visibility for WooCommerce WordPress plugin. The vulnerability stems from improper control of filename parameters used in PHP include/require statements, allowing attackers to include arbitrary local files from the server's filesystem. This type of vulnerability (CWE-98) can lead to sensitive information disclosure, configuration file exposure, and in some cases, remote code execution when combined with other attack techniques.
Attackers can exploit this vulnerability to read sensitive files from the WordPress installation, potentially exposing database credentials, API keys, and other configuration secrets stored on the server.
The Checkout Field Visibility for WooCommerce plugin contains a PHP Local File Inclusion vulnerability due to improper validation of user-supplied input used in file inclusion operations. The vulnerability allows an attacker to manipulate filename parameters that are passed to PHP's include() or require() functions without adequate sanitization.
When successfully exploited, an attacker can traverse directory structures and include arbitrary files from the local filesystem. This can result in exposure of sensitive configuration files such as wp-config.php , which contains database credentials, authentication keys, and other critical WordPress settings.
The root cause of this vulnerability is the lack of proper input validation and sanitization for user-controlled parameters that determine which PHP files are included. The plugin fails to implement adequate allowlist-based validation or proper canonicalization of file paths before using them in include statements. This allows attackers to use path traversal sequences (such as ../ ) to escape intended directories and access arbitrary files on the server.
The vulnerability is exploited by submitting crafted requests containing path traversal sequences to parameters that control file inclusion. An attacker can manipulate these parameters to include local files outside the intended directory scope.
For example, an attacker might craft a request that traverses up the directory tree to access the WordPress configuration file or other sensitive system files. When combined with writable log files or uploaded content, this LFI vulnerability could potentially be escalated to achieve remote code execution through log poisoning or similar techniques.
The attack requires network access to the vulnerable WordPress installation but does not necessarily require authentication, depending on how the affected functionality is exposed. See the Patchstack security advisory for detailed technical information.
The vulnerability affects Checkout Field Visibility for WooCommerce versions through 1.3.0 . Users should check the Patchstack advisory and the WordPress plugin repository for updated versions containing the security fix. the plugin developer (zamartz) for information on patched releases.
Disclaimer : This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
