CVE-2025-60190: 
WordPress vulnerability analysis and mitigation

CVE-2025-60190 is a Local File Inclusion (LFI) vulnerability in the Immocaster WordPress Plugin by Hinnerk Altenburg, affecting all versions up to and including 1.3.6. The flaw stems from improper control of filenames used in PHP include/require statements (CWE-98), allowing unauthenticated remote attackers to include and execute arbitrary local files on the server. The vulnerability was reported by ArilAprilio on June 28, 2025, and published by Patchstack on July 28, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which maps to CAPEC-193 (PHP Remote File Inclusion). Despite the CWE classification referencing remote file inclusion, the exploitable attack vector in this case is Local File Inclusion — the plugin fails to properly sanitize or validate user-supplied input used to construct file paths passed to PHP's include/require functions. This allows an unauthenticated attacker to manipulate the filename parameter to traverse the file system and include sensitive local files. No authentication or user interaction is required, though exploitation is rated as high complexity (Patchstack).

Successful exploitation allows an unauthenticated attacker to include and render arbitrary local files from the server, potentially exposing sensitive configuration files such as wp-config.php (which contains database credentials), system files like /etc/passwd, or other sensitive data stored on the server. Depending on server configuration, this could escalate to remote code execution if an attacker can control file contents (e.g., via log poisoning or uploaded files). The vulnerability poses high risks to confidentiality, integrity, and availability, and could enable complete database takeover or full site compromise (Patchstack).

As of the time of publication, there is no known public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation. The EPSS score is approximately 0.046%, indicating a low current probability of exploitation. No threat actor attribution has been reported, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack classifies it as high priority and notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting WordPress sites at scale (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Immocaster plugin (version ≤ 1.3.6) using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/plugins/immocaster).
2. Identify vulnerable parameter: Analyze the plugin's PHP source code or HTTP requests to locate the input parameter used in an unsanitized include() or require() call.
3. Craft malicious request: Construct an HTTP request (GET or POST) that supplies a path-traversal payload to the vulnerable parameter, e.g., ../../../../wp-config.php or /etc/passwd.
4. Trigger file inclusion: Submit the crafted request to the vulnerable endpoint; if successful, the server will include and render the contents of the targeted local file in the HTTP response.
5. Escalate (optional): If the server allows file uploads (e.g., via WordPress media), upload a PHP web shell disguised as an image, then use the LFI to include it and achieve remote code execution (Patchstack).

• Network: Unusual HTTP requests to Immocaster plugin endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body.
• Logs: WordPress or web server access logs showing requests to plugin URLs with encoded traversal strings; HTTP 200 responses to requests targeting sensitive files like wp-config.php or /etc/passwd.
• File System: Unexpected PHP files or web shells in the WordPress uploads directory (wp-content/uploads/) or plugin directory.
• Process: Unusual child processes spawned by the web server process (e.g., bash, curl, wget) following requests to the Immocaster plugin endpoint.

As of the publication date, no official patch from the plugin developer is available for the Immocaster WordPress Plugin. Patchstack has issued a virtual patching/mitigation rule for its users to block exploitation attempts until an official fix is released. Recommended actions include: immediately deactivating and removing the Immocaster plugin if it is not essential; restricting PHP file inclusion via php.ini settings (allow_url_include = Off); implementing a Web Application Firewall (WAF) rule to block path traversal patterns; and monitoring for a patched version (beyond 1.3.6) from the plugin developer (Patchstack).