CVE-2025-60202: 
WordPress vulnerability analysis and mitigation

CVE-2025-60202 is a Local File Inclusion (LFI) vulnerability in the WordPress Favorites plugin by Kyle Phillips, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects all versions of the plugin up to and including 2.3.6, with no official patch available as of the time of disclosure. The vulnerability was reported on June 21, 2025, and published by Patchstack on July 21, 2025. It carries a CVSS v3.1 base score of 7.5 (High) (Patchstack).

The root cause is improper control of filenames used in PHP include/require statements (CWE-98), which allows an attacker to manipulate file path inputs to include arbitrary local files from the server's filesystem. Exploitation requires no authentication (unauthenticated attacker role) but does require user interaction — a privileged user must perform an action such as clicking a malicious link or visiting a crafted page. The attack is delivered over the network with high attack complexity, and the vulnerability is classified under OWASP Top 10 category A3: Injection (Patchstack).

Successful exploitation allows an attacker to include and expose the contents of arbitrary local files on the web server, including sensitive configuration files such as wp-config.php, which contains database credentials. This could lead to complete database takeover, exposure of secret keys, and further compromise of the WordPress installation. The vulnerability has high confidentiality, integrity, and availability impact per its CVSS scoring (Patchstack).

No official patch is currently available, and Patchstack has assessed this vulnerability as high priority, noting it is expected to be used in mass-exploit campaigns targeting thousands of websites regardless of their size or popularity. The EPSS score is approximately 0.056% (0.000560), indicating a relatively low but non-negligible probability of exploitation in the near term. No specific threat actor attribution or confirmed in-the-wild exploitation has been reported at this time. The vulnerability is not currently listed in the CISA KEV catalog (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Favorites plugin version ≤ 2.3.6 using tools like WPScan, Shodan, or Google dorks targeting plugin-specific files.
2. Craft malicious payload: Construct a URL or form input that manipulates the file path parameter used in the plugin's PHP include/require statement to reference a sensitive local file (e.g., ../../../../wp-config.php).
3. Trigger user interaction: Deliver the crafted link or page to a privileged WordPress user (e.g., via phishing or social engineering) to trigger the vulnerable code path upon interaction.
4. Extract sensitive data: Upon successful inclusion, the server renders the contents of the targeted local file (e.g., database credentials from wp-config.php) in the HTTP response, which the attacker captures.
5. Escalate access: Use extracted credentials (e.g., database username/password) to access the WordPress database directly, enabling full site takeover, data exfiltration, or further lateral movement (Patchstack).

• Network: Unusual HTTP requests to WordPress pages with file path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body fields associated with the Favorites plugin.
• Logs: Web server access logs showing requests with path traversal patterns targeting Favorites plugin endpoints; HTTP 200 responses to requests containing wp-config, passwd, or other sensitive file names in parameters.
• File System: No new files expected from LFI alone, but monitor for unexpected file reads of sensitive files (e.g., wp-config.php, /etc/passwd) by the web server process.
• Process: PHP error logs showing failed file inclusion attempts with unusual path strings, or successful inclusions of non-plugin files (Patchstack).

No official patch from the plugin developer (Kyle Phillips) is currently available for versions ≤ 2.3.6. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts until an official fix is released. Site administrators are advised to deactivate and remove the Favorites plugin until a patched version becomes available, or contact their hosting provider for assistance. Alternatively, implementing a Web Application Firewall (WAF) with LFI detection rules can provide interim protection (Patchstack).

The vulnerability was discovered and reported by security researcher LVT-tholv2k and disclosed through Patchstack's Vulnerability Disclosure Program (VDP) on July 21, 2025. Patchstack has flagged it as high priority, warning that vulnerabilities of this class are commonly leveraged in mass-exploit campaigns against WordPress sites. No broader media coverage or notable social media discussion has been identified at this time (Patchstack).