Cyber Posture

CVE-2025-60072

High

Published: 18 December 2025

Published
18 December 2025
Modified
27 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0022 44.7th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Anchor smooth scroll anchor-smooth-scroll allows PHP Local File Inclusion.This issue affects Anchor smooth scroll: from n/a through <= 1.0.2.

Mitigating Controls (NIST 800-53 r5)AI

prevent

Directly requires identification, reporting, and timely remediation of flaws such as this PHP LFI vulnerability in the Anchor Smooth Scroll WordPress plugin through patching or updates.

prevent

Mandates validation of information inputs like filenames used in PHP include/require statements to block local file inclusion exploits.

preventdetect

Enforces boundary protection via web application firewalls or proxies to monitor and block network-based file inclusion attack payloads targeting this CVE.

Security SummaryAI

CVE-2025-60072 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, described as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion, affecting the WordPress plugin Anchor Smooth Scroll by Processby. This flaw impacts all versions of the plugin from n/a through 1.0.2.

The vulnerability carries a CVSS v3.1 base score of 8.1 (High), with the vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Unauthenticated remote attackers can exploit it over the network with high attack complexity and without requiring user interaction, potentially achieving high impacts on confidentiality, integrity, and availability through local file inclusion, such as arbitrary code execution.

Patchstack provides details on the vulnerability in its advisory at https://patchstack.com/database/Wordpress/Plugin/anchor-smooth-scroll/vulnerability/wordpress-anchor-smooth-scroll-plugin-1-0-2-local-file-inclusion-vulnerability?_s_id=cve, which security practitioners should consult for mitigation guidance related to the affected plugin versions.

Details

CWE(s)

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a remote file inclusion (RFI/LFI) flaw in a public-facing WordPress plugin, enabling unauthenticated attackers to achieve arbitrary code execution, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References