CVE-2025-60190
Published: 06 November 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-60190 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion, in the Immocaster WordPress Plugin developed by Hinnerk Altenburg. The flaw enables PHP Local File Inclusion and affects the immocaster plugin from its initial version (n/a) through version 1.3.6. Published on 2025-11-06, it carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-98.
A network-based attacker requires no privileges or user interaction but must overcome high attack complexity to exploit the vulnerability remotely. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing the attacker to include and execute arbitrary local PHP files on the server.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/immocaster/vulnerability/wordpress-immocaster-wordpress-plugin-plugin-1-3-6-local-file-inclusion-vulnerability?_s_id=cve provides further details on the vulnerability, including mitigation recommendations.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability is a PHP Remote/Local File Inclusion in a public-facing WordPress plugin, directly enabling exploitation of a public-facing application for remote code execution.