Cyber Posture

CVE-2025-60190

High

Published: 06 November 2025

Published
06 November 2025
Modified
27 April 2026
KEV Added
Patch
CVSS Score 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0011 28.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

Security Summary

CVE-2025-60190 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion, in the Immocaster WordPress Plugin developed by Hinnerk Altenburg. The flaw enables PHP Local File Inclusion and affects the immocaster plugin from its initial version (n/a) through version 1.3.6. Published on 2025-11-06, it carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-98.

A network-based attacker requires no privileges or user interaction but must overcome high attack complexity to exploit the vulnerability remotely. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing the attacker to include and execute arbitrary local PHP files on the server.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/immocaster/vulnerability/wordpress-immocaster-wordpress-plugin-plugin-1-3-6-local-file-inclusion-vulnerability?_s_id=cve provides further details on the vulnerability, including mitigation recommendations.

Details

CWE(s)
CWE-98

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Why these techniques?

The vulnerability is a PHP Remote/Local File Inclusion in a public-facing WordPress plugin, directly enabling exploitation of a public-facing application for remote code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References