CVE-2025-60200: 
WordPress vulnerability analysis and mitigation

CVE-2025-60200 is a Local File Inclusion (LFI) vulnerability in the ThimPress LearnPress Export Import WordPress plugin, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the learnpress-import-export plugin through version 4.1.2, and was reported by researcher LVT-tholv2k on June 21, 2025, with public disclosure on July 21, 2025. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The root cause is improper validation of user-supplied input used in PHP include/require statements, allowing an attacker to manipulate the filename parameter to include arbitrary local files from the server (CWE-98). The attack vector is network-based, but exploitation requires user interaction — a privileged user must perform an action such as clicking a malicious link or submitting a crafted form. No authentication is required on the attacker's side, though the social engineering component introduces complexity. The vulnerability is classified under OWASP Top 10 category A3: Injection (Patchstack).

Successful exploitation allows an attacker to include and expose the contents of arbitrary local files on the web server, including sensitive configuration files such as wp-config.php, which contains database credentials. This could lead to complete database takeover, exposure of API keys and secrets, and potentially further compromise of the WordPress installation or underlying server. Confidentiality, integrity, and availability are all rated as HIGH impact (Patchstack).

No public proof-of-concept exploit code has been identified at this time. Patchstack rates this vulnerability as high priority and notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting thousands of WordPress sites regardless of traffic or popularity. The EPSS score is approximately 0.056% (0.000560), indicating a currently low but non-negligible probability of exploitation in the near term. There is no current evidence of active in-the-wild exploitation or CISA KEV catalog listing (Patchstack).

1. Reconnaissance: Identify WordPress sites running the LearnPress Export Import plugin version 4.1.2 or earlier using tools like WPScan, Shodan, or Google dorks targeting plugin-specific paths.
2. Craft malicious payload: Prepare a crafted URL or form submission that manipulates the filename parameter used in the plugin's PHP include/require statement to reference a sensitive local file (e.g., ../../../../wp-config.php).
3. Social engineering: Deliver the malicious link or crafted page to a user with sufficient privileges on the target WordPress site, inducing them to click or submit the form (user interaction is required for exploitation).
4. Trigger file inclusion: Upon the privileged user's interaction, the plugin processes the manipulated filename parameter and includes the specified local file, rendering its contents in the HTTP response.
5. Exfiltrate sensitive data: Capture the server response containing the included file's contents (e.g., database credentials from wp-config.php) and use them for further attacks such as database access or full site takeover (Patchstack).

• Network: Unusual HTTP requests to LearnPress Export Import plugin endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in parameters; unexpected outbound connections from the web server following plugin interaction.
• Logs: WordPress or web server access logs showing requests with path traversal patterns targeting plugin endpoints; error log entries related to PHP file inclusion failures for unexpected file paths.
• File System: Unexpected access timestamps on sensitive files such as wp-config.php or /etc/passwd correlating with suspicious plugin activity.
• Process: PHP processes reading files outside the WordPress web root or plugin directory unexpectedly (Patchstack).

Update the LearnPress Export Import plugin to version 4.1.3 or later, which contains the patch for this vulnerability. If an immediate update is not possible, Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until the plugin is updated. Site administrators should also consider restricting access to plugin import/export functionality to trusted users only as a defense-in-depth measure (Patchstack).