CVE-2025-60150: 
WordPress vulnerability analysis and mitigation

CVE-2025-60150 is a Local File Inclusion (LFI) vulnerability in the Subscribe to Download WordPress plugin by wpshuffle, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the plugin up to and including 2.0.9, and was publicly disclosed on September 26, 2025. The vulnerability was reported by researcher João Pedro S Alcântara (Kinorth) on June 5, 2025, and assigned a CVSS v3.1 base score of 7.5 (High) (Patchstack, Red Hat CVE).

The vulnerability stems from improper control of filenames used in PHP include/require statements (CWE-98), which allows an attacker to manipulate file path inputs to include arbitrary local files from the server's filesystem. Exploitation requires the attacker to have at least Contributor- or Developer-level privileges on the WordPress site, and the attack complexity is rated High, indicating that specific conditions must be met. The flaw is classified under OWASP Top 10 category A3: Injection, and is mapped to CAPEC-193 (PHP Remote File Inclusion), though the practical impact is local file inclusion rather than remote (Patchstack).

Successful exploitation allows a malicious actor to include and expose the contents of arbitrary local files on the web server, including sensitive configuration files such as wp-config.php which contains database credentials. This could lead to complete database takeover depending on server configuration, as well as exposure of other sensitive data stored on the filesystem. The confidentiality, integrity, and availability impacts are all rated High in the CVSS scoring (Patchstack).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is approximately 0.127%, indicating a low probability of exploitation in the near term. Patchstack rates the priority as Low, noting the issue is unlikely to be exploited, though they acknowledge that LFI-class vulnerabilities can be used in mass-exploit campaigns targeting WordPress sites at scale. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Subscribe to Download plugin version ≤ 2.0.9 using tools like WPScan, Shodan, or by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/subscribe-to-download/readme.txt.
2. Obtain required privileges: Authenticate to the WordPress site with at least Contributor or Developer-level credentials, which may be obtained through credential stuffing, phishing, or brute force.
3. Identify vulnerable parameter: Locate the plugin's functionality that accepts a filename or path parameter used in a PHP include/require statement within the plugin's code.
4. Craft LFI payload: Submit a crafted request with a manipulated file path (e.g., using path traversal sequences like ../../wp-config.php) to the vulnerable parameter to force the server to include a sensitive local file.
5. Exfiltrate data: Review the server's response to extract the contents of the included file, such as database credentials from wp-config.php, and use those credentials for further access or lateral movement (Patchstack).

• Logs: WordPress access logs showing requests to plugin endpoints with path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in parameter values; repeated HTTP requests from a single authenticated user to plugin-related endpoints.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or other system files reflected in PHP error logs or access logs.
• Logs: PHP error logs showing file inclusion warnings or errors referencing unexpected file paths outside the plugin's directory.

The vendor (wpshuffle) has released version 2.1.0 of the Subscribe to Download plugin, which patches this vulnerability. WordPress site administrators should update the plugin to version 2.1.0 or later immediately via the WordPress admin dashboard or by downloading from the WordPress plugin repository. If an immediate update is not possible, consider temporarily deactivating the plugin or restricting access to the WordPress admin area. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard (Patchstack).

The vulnerability was covered in Wordfence's weekly WordPress vulnerability report for the period of September 22–28, 2025, which aggregates newly disclosed plugin vulnerabilities for the WordPress community (Wordfence Blog). Patchstack, the assigning CNA, classified the issue as low priority with no impactful threat, reflecting a measured community response. No significant independent researcher commentary or broader media coverage has been identified.