CVE-2025-60192: 
WordPress vulnerability analysis and mitigation

CVE-2025-60192 is a Local File Inclusion (LFI) vulnerability in the Premmerce Wholesale Pricing for WooCommerce WordPress plugin, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the plugin up to and including 1.1.10, and was reported by researcher LVT-tholv2k on June 28, 2025, with public disclosure on July 28, 2025. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The root cause is improper control of filename parameters used in PHP include/require statements (CWE-98), which allows an attacker to manipulate file path inputs to include arbitrary local files on the server. The attack vector is network-based, requires no authentication (unauthenticated exploitation), but does require user interaction — meaning a privileged user must perform an action such as clicking a malicious link or visiting a crafted page. This falls under OWASP Top 10 category A3: Injection and is mapped to CAPEC-193 (PHP Remote File Inclusion). No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows a malicious actor to include and expose the contents of arbitrary local files on the web server, including sensitive configuration files such as wp-config.php, which contains database credentials. This could lead to complete database takeover, exposure of secret keys, and potentially full site compromise depending on server configuration. The confidentiality, integrity, and availability impacts are all rated High (Patchstack).

No confirmed in-the-wild exploitation has been reported at this time. The EPSS score is approximately 0.052%, indicating a low but non-negligible probability of exploitation in the near term. Patchstack classifies this as High priority and notes that vulnerabilities of this type are commonly used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity. The vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Premmerce Wholesale Pricing for WooCommerce plugin version ≤ 1.1.10 using tools like WPScan, Shodan, or by inspecting plugin directories on target sites.
2. Craft malicious payload: Prepare a request or link that manipulates a filename parameter accepted by the vulnerable plugin to reference a sensitive local file (e.g., ../../../../wp-config.php).
3. Trigger user interaction: Deliver the crafted link or page to a privileged WordPress user (e.g., administrator) via phishing, social engineering, or embedding in a comment/post, as user interaction is required for exploitation.
4. Achieve file inclusion: When the privileged user triggers the action, the plugin processes the manipulated filename parameter and includes the specified local file, returning its contents in the HTTP response.
5. Extract sensitive data: Parse the response to extract credentials (e.g., database username/password from wp-config.php), secret keys, or other sensitive configuration data for further exploitation such as database access or privilege escalation (Patchstack).

• Network: Unusual HTTP requests to WordPress plugin endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields associated with the premmerce-woocommerce-wholesale-pricing plugin.
• Logs: WordPress or web server access logs showing requests to plugin-related PHP files with suspicious filename parameters referencing system files (e.g., wp-config.php, /etc/passwd); repeated 200 responses to such requests may indicate successful inclusion.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php or system configuration files that correlate with suspicious web requests.
• Process: PHP processes reading files outside the expected WordPress directory tree, observable via server-side monitoring or file integrity tools.

The vendor Premmerce has released version 1.1.11 of the Premmerce Wholesale Pricing for WooCommerce plugin, which patches this vulnerability. Site administrators should update to version 1.1.11 or later immediately via the WordPress plugin dashboard. Patchstack users benefit from an automatically deployed virtual patch (mitigation rule) that blocks exploitation attempts until the plugin is updated; enabling auto-update for vulnerable plugins is also recommended (Patchstack).

The vulnerability was discovered and disclosed through Patchstack's Vulnerability Disclosure Program (VDP), with researcher LVT-tholv2k credited for the report. Patchstack has classified it as High priority and flagged it as the type of vulnerability commonly leveraged in mass WordPress exploit campaigns. No significant broader media coverage or notable social media commentary has been identified beyond the Patchstack advisory (Patchstack).