CVE-2025-68552: 
WordPress vulnerability analysis and mitigation

CVE-2025-68552 is a PHP Local File Inclusion (LFI) vulnerability in the WooCommerce Coming Soon Product with Countdown WordPress plugin by WebCodingPlace. The flaw stems from improper control of filename parameters used in PHP include/require statements (CWE-98), allowing authenticated attackers to include arbitrary local files. All plugin versions up to and including 5.0 are affected. It was published on February 20, 2026, and carries a CVSS v3.1 base score of 6.3 (Medium) (Feedly, Wordfence).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The plugin fails to properly sanitize or validate user-supplied input before passing it to a PHP include or require statement, enabling an attacker to manipulate the filename parameter to reference arbitrary files on the server's local filesystem. Exploitation requires a low-privilege authenticated account (e.g., a subscriber or customer role on a WooCommerce-enabled site) and no user interaction, making it accessible to a broad range of potential attackers. The attack vector is network-based with low complexity (Feedly).

Successful exploitation allows an authenticated attacker to read sensitive local files on the server (e.g., configuration files containing database credentials, WordPress wp-config.php), potentially leading to credential theft and further compromise. Integrity and availability are also assessed as low-impact, suggesting limited potential for file manipulation or service disruption through this vector alone. However, chaining the LFI with other vulnerabilities (e.g., log poisoning or file upload flaws) could escalate to remote code execution and full site takeover (Feedly).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported for CVE-2025-68552 as of the latest available data. The EPSS score is 0.049%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a low-privileged authenticated account on the target WordPress/WooCommerce site (Feedly).

1. Reconnaissance: Identify WordPress sites running the WooCommerce Coming Soon Product with Countdown plugin (version ≤ 5.0) using tools like WPScan or Shodan queries for the plugin's known file paths.
2. Authentication: Obtain or register a low-privilege account on the target site (e.g., a WooCommerce customer account).
3. Identify vulnerable parameter: Locate the plugin's endpoint or shortcode that accepts a filename or template parameter passed to a PHP include/require statement.
4. Craft LFI payload: Submit a crafted request with a manipulated filename parameter using path traversal sequences (e.g., ../../../../wp-config.php) to reference sensitive local files.
5. Exfiltrate data: Review the server response for the contents of the included file, extracting credentials or other sensitive configuration data for further exploitation.

• Logs: WordPress/Apache/Nginx access logs showing authenticated requests to plugin-related endpoints with path traversal sequences (e.g., ../, %2e%2e%2f) in parameter values.
• Logs: PHP error logs referencing unexpected file inclusion attempts or include/require failures for files outside the plugin directory.
• Network: Repeated authenticated POST or GET requests to plugin-specific URLs from a single low-privilege user account in a short timeframe.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or server configuration files coinciding with suspicious request activity.

The primary remediation is to update the WooCommerce Coming Soon Product with Countdown plugin to a version beyond 5.0 once a patched release is made available by WebCodingPlace. If no patch is yet available, site administrators should consider deactivating and removing the plugin until a fix is released. Additionally, implementing a Web Application Firewall (WAF) rule to block path traversal patterns in request parameters can serve as a temporary mitigation. Restricting user registration or limiting low-privilege account creation on the site reduces the attacker's ability to meet the authentication precondition (Feedly, Wordfence).

Wordfence included CVE-2025-68552 in its weekly WordPress vulnerability report for the period of February 9–15, 2026, flagging it as part of a broader set of plugin vulnerabilities tracked that week (Wordfence). No significant independent researcher commentary, vendor statements beyond the CVE filing, or notable social media discussion has been identified for this vulnerability.