CVE-2025-60074: 
WordPress vulnerability analysis and mitigation

CVE-2025-60074 is a Local File Inclusion (LFI) vulnerability in the Lazy Load Optimizer WordPress plugin by Processby, affecting all versions up to and including 1.4.7. The flaw was reported on June 28, 2025, and publicly disclosed by Patchstack on July 28, 2025. It carries a CVSS v3.1 base score of 7.5 (High), and no official patch from the developer was available at the time of disclosure (Patchstack).

The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which enables PHP Local File Inclusion. An unauthenticated attacker can manipulate file path parameters used in PHP include/require statements within the plugin, causing the server to include arbitrary local files. Exploitation requires user interaction — a privileged user must perform an action such as clicking a malicious link or visiting a crafted page — and the attack complexity is rated High (Patchstack).

Successful exploitation allows an attacker to include and expose the contents of arbitrary local files on the web server, including sensitive configuration files such as wp-config.php, which contains database credentials. This could lead to complete database takeover, exposure of authentication secrets, and potential for further lateral movement within the hosting environment. Confidentiality, integrity, and availability are all rated as High impact (Patchstack).

No official patch was available at the time of disclosure, and Patchstack has characterized this vulnerability as highly dangerous and expected to be exploited in mass-exploit campaigns targeting thousands of WordPress sites regardless of their size or popularity. The EPSS score is approximately 0.052% (0.000520), indicating a currently low but non-negligible probability of exploitation in the near term. There is no confirmed in-the-wild exploitation or CISA KEV listing at this time, though Patchstack has issued a virtual patching/mitigation rule for its subscribers (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Lazy Load Optimizer plugin (version ≤ 1.4.7) using tools like WPScan, Shodan, or by inspecting plugin directories via exposed readme.txt files.
2. Craft malicious request: Construct a URL or form submission targeting the vulnerable plugin endpoint that accepts a file path parameter used in a PHP include/require statement.
3. Social engineering (if required): Since user interaction is required, craft a malicious link or page that, when visited or clicked by a logged-in WordPress user, triggers the vulnerable code path with an attacker-controlled file path.
4. Inject LFI payload: Supply a path traversal sequence (e.g., ../../../../wp-config.php) as the file parameter value to direct the include statement to a sensitive local file.
5. Exfiltrate data: The server returns the contents of the included file (e.g., database credentials from wp-config.php) in the HTTP response, which the attacker captures for further exploitation such as database access or privilege escalation (Patchstack).

• Network: HTTP requests to WordPress plugin endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields associated with the Lazy Load Optimizer plugin.
• Logs: Web server access logs showing requests to plugin-related PHP files with unusual file path parameters; PHP error logs referencing unexpected file inclusion attempts or include/require failures for system files.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php, /etc/passwd, or other system configuration files that should not be read by the web process.
• Process: PHP processes reading files outside the WordPress web root, particularly sensitive configuration files, as observable via system audit tools (e.g., auditd on Linux).

As of the disclosure date (July 28, 2025), no official patch from the plugin developer (Processby) was available. Site administrators are advised to deactivate and remove the Lazy Load Optimizer plugin immediately until a patched version is released. Patchstack has issued a virtual patching rule for its subscribers that blocks exploitation attempts without requiring a code-level fix. Additionally, implementing a Web Application Firewall (WAF) rule to block path traversal patterns in HTTP requests can reduce exposure (Patchstack).

Patchstack, the CVE assigner and disclosing organization, has rated this vulnerability as high priority and warned that LFI vulnerabilities of this type are commonly used in mass-exploit campaigns against WordPress sites. The vulnerability was credited to researcher LVT-tholv2k, who reported it on June 28, 2025. No significant broader media coverage or notable social media discussion has been identified beyond the Patchstack advisory (Patchstack).