CVE-2025-60197: 
WordPress vulnerability analysis and mitigation

CVE-2025-60197 is a Local File Inclusion (LFI) vulnerability in the Simple Contact Forms WordPress plugin by owenr88, caused by improper control of filenames in PHP include/require statements. It affects all versions of the plugin up to and including 1.6.4. The vulnerability was reported on June 22, 2025, by researcher LVT-tholv2k and published by Patchstack on July 22, 2025. It carries a CVSS v3.1 base score of 8.1 (High) (Patchstack).

The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). Insufficient validation of user-supplied input allows an attacker to manipulate the filename parameter passed to a PHP include() or require() statement, causing the server to include arbitrary local files. Exploitation requires no authentication and no user interaction, but is rated as high attack complexity (AC:H), suggesting that specific conditions or non-default configurations may need to be met. No public proof-of-concept code has been identified at this time (Patchstack).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files on the web server, including sensitive configuration files such as wp-config.php, which contains database credentials. This can lead to full database compromise, exposure of API keys or secrets, and potentially further lateral movement within the hosting environment. The CVSS assessment rates confidentiality, integrity, and availability impacts all as HIGH (Patchstack).

As of the time of publication, there is no known public proof-of-concept exploit and no confirmed in-the-wild exploitation. The EPSS score is approximately 0.056%, indicating a low current probability of exploitation in the near term. No threat actor attribution or CISA KEV catalog listing has been identified. Patchstack classifies this as high priority, noting that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Simple Contact Forms plugin (version ≤ 1.6.4) using tools like WPScan, Shodan, or Google dorks (e.g., inurl:wp-content/plugins/simple-contact-forms).
2. Identify vulnerable parameter: Analyze the plugin's PHP source code or observed HTTP requests to locate the input parameter that is passed unsanitized to a PHP include() or require() call.
3. Craft malicious request: Send an unauthenticated HTTP request to the vulnerable endpoint with a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd).
4. Retrieve file contents: If the server processes the request, the contents of the targeted local file are returned in the HTTP response, exposing credentials or other sensitive data.
5. Escalate access: Use extracted database credentials from wp-config.php to access the WordPress database directly, enabling account takeover, data exfiltration, or further compromise of the hosting environment (Patchstack).

• Network: Unusual HTTP GET or POST requests to Simple Contact Forms plugin endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in parameter values; requests originating from automated scanning tools (high request rate, sequential probing).
• Logs: WordPress or web server access logs showing requests to plugin URLs with encoded or raw directory traversal strings; HTTP 200 responses to requests containing file path patterns like wp-config.php or /etc/passwd.
• File System: No direct file system artifacts expected for read-only LFI, but monitor for unexpected file reads of wp-config.php or system files by the web server process.
• Process: Web server process (e.g., apache2, nginx, php-fpm) accessing files outside the WordPress web root, detectable via auditd or similar file access monitoring tools.

No official patch is currently available for the Simple Contact Forms plugin as of the publication date; Patchstack reports the patched version as unavailable. Organizations should consider deactivating and removing the plugin until an official fix is released. Patchstack has issued a virtual patch/mitigation rule for subscribers to block exploitation attempts automatically. Additionally, deploying a Web Application Firewall (WAF) with rules targeting path traversal and LFI patterns, and restricting direct access to plugin endpoints, can reduce risk (Patchstack).

Patchstack, which discovered and disclosed the vulnerability through researcher LVT-tholv2k, classifies it as high priority and warns that LFI vulnerabilities of this type are commonly leveraged in mass-exploit campaigns against WordPress sites. No significant broader media coverage or notable social media commentary has been identified beyond the Patchstack advisory (Patchstack).