CVE-2025-60087: 
WordPress vulnerability analysis and mitigation

CVE-2025-60087 is a PHP Local File Inclusion (LFI) vulnerability in the Extensive VC Addons for WPBakery Page Builder WordPress plugin, developed by Nenad Obradovic. The flaw stems from improper control of filename parameters used in PHP include/require statements (CWE-98). All versions through 1.9.1 are affected. The vulnerability was published on February 20, 2026, and carries a CVSS v3.1 base score of 8.1 (High) (Feedly).

The root cause is classified as CWE-98 — Improper Control of Filename for Include/Require Statement in PHP Program — where user-supplied input is passed unsanitized to a PHP file inclusion function. This allows a remote, unauthenticated attacker to manipulate the filename parameter to include arbitrary local files on the server, potentially executing PHP code present on the filesystem. No authentication or user interaction is required, though the attack complexity is rated High, suggesting some precondition (such as knowledge of a writable or accessible file path) must be met (Feedly).

Successful exploitation can result in unauthorized disclosure of sensitive files (e.g., WordPress configuration files containing database credentials), arbitrary PHP code execution via log poisoning or other file-upload chaining techniques, and full compromise of the WordPress installation. The confidentiality, integrity, and availability impacts are all rated High, meaning an attacker could exfiltrate data, modify site content, or render the site unavailable (Feedly).

As of the time of reporting, no public proof-of-concept exploit code has been identified, and there is no evidence of active in-the-wild exploitation. The EPSS score is approximately 0.053%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Feedly).

1. Reconnaissance: Identify WordPress sites running the Extensive VC Addons for WPBakery Page Builder plugin (version ≤ 1.9.1) using tools like WPScan, Shodan, or by inspecting plugin directories via exposed readme.txt files.
2. Identify vulnerable parameter: Analyze the plugin's PHP source code or public disclosures to locate the specific parameter passed to a PHP include() or require() function without proper sanitization.
3. Craft malicious request: Send a crafted HTTP request to the vulnerable endpoint, manipulating the filename parameter to reference a sensitive local file (e.g., ../../../../wp-config.php) or a previously uploaded/poisoned file containing PHP code.
4. Achieve file disclosure or code execution: If targeting sensitive files, the server returns their contents in the HTTP response. If chaining with a file upload or log poisoning technique, the included file executes arbitrary PHP, potentially establishing a web shell or reverse shell.
5. Post-exploitation: Use obtained credentials (e.g., from wp-config.php) or shell access to escalate privileges, pivot to the database, or further compromise the hosting environment (Feedly).

• Network: Unusual HTTP GET or POST requests to plugin-related endpoints containing directory traversal sequences (e.g., ../, ..%2F, ....//) or references to sensitive files such as wp-config.php.
• Logs: Web server access logs showing requests with encoded path traversal patterns targeting WPBakery addon endpoints; PHP error logs indicating failed or successful file inclusion of unexpected paths.
• File System: Presence of unexpected PHP web shells in the WordPress uploads directory or plugin folders; newly created or modified PHP files not associated with legitimate plugin updates.
• Process: Unusual PHP child processes spawning system commands (e.g., bash, curl, wget) from the web server process (Feedly).

The primary remediation is to update the Extensive VC Addons for WPBakery Page Builder plugin to a version newer than 1.9.1 as soon as a patched release becomes available. If no patch is currently available, administrators should deactivate and remove the plugin immediately. Additional mitigations include deploying a Web Application Firewall (WAF) with rules to detect and block path traversal and file inclusion attempts, restricting web server file permissions to limit access to sensitive files, and monitoring server logs for suspicious inclusion patterns (Feedly).