CVE-2025-26933: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability (CVE-2025-26933) was discovered in Nitin Prakash's WC Place Order Without Payment WordPress plugin affecting versions through 2.6.7. The vulnerability was reported on February 7, 2025, and publicly disclosed on February 23, 2025 (Patchstack).

The vulnerability is classified as an Improper Control of Filename for Include/Require Statement in PHP Program (PHP Remote File Inclusion). It has received a CVSS v3.1 Base Score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H (Patchstack).

This vulnerability could allow an unauthenticated attacker to include local files of the target website and display their contents. Particularly sensitive files containing credentials, such as database configuration files, could be exposed, potentially leading to complete database compromise depending on the system configuration (Patchstack).

The vulnerability has been fixed in version 2.6.8 of the plugin. Users are strongly advised to update to version 2.6.8 or later immediately. For users of Patchstack, a virtual patch has been issued to mitigate this issue by blocking potential attacks until the update can be applied (Patchstack).