CVE-2025-60072
Published: 18 December 2025
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Anchor smooth scroll anchor-smooth-scroll allows PHP Local File Inclusion.This issue affects Anchor smooth scroll: from n/a through <= 1.0.2.
Mitigating Controls (NIST 800-53 r5)AI
Directly requires identification, reporting, and timely remediation of flaws such as this PHP LFI vulnerability in the Anchor Smooth Scroll WordPress plugin through patching or updates.
Mandates validation of information inputs like filenames used in PHP include/require statements to block local file inclusion exploits.
Enforces boundary protection via web application firewalls or proxies to monitor and block network-based file inclusion attack payloads targeting this CVE.
Security SummaryAI
CVE-2025-60072 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, described as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion, affecting the WordPress plugin Anchor Smooth Scroll by Processby. This flaw impacts all versions of the plugin from n/a through 1.0.2.
The vulnerability carries a CVSS v3.1 base score of 8.1 (High), with the vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Unauthenticated remote attackers can exploit it over the network with high attack complexity and without requiring user interaction, potentially achieving high impacts on confidentiality, integrity, and availability through local file inclusion, such as arbitrary code execution.
Patchstack provides details on the vulnerability in its advisory at https://patchstack.com/database/Wordpress/Plugin/anchor-smooth-scroll/vulnerability/wordpress-anchor-smooth-scroll-plugin-1-0-2-local-file-inclusion-vulnerability?_s_id=cve, which security practitioners should consult for mitigation guidance related to the affected plugin versions.
Details
- CWE(s)
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a remote file inclusion (RFI/LFI) flaw in a public-facing WordPress plugin, enabling unauthenticated attackers to achieve arbitrary code execution, directly mapping to exploitation of public-facing applications.