CVE-2025-60241: 
WordPress vulnerability analysis and mitigation

CVE-2025-60241 is a Local File Inclusion (LFI) vulnerability in the Premmerce WordPress plugin affecting all versions up to and including 1.3.19. The flaw is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) and was reported by researcher Ryan Novotny on June 2, 2025, with public disclosure on July 2, 2025. The vulnerability carries a CVSS v3.1 base score of 7.5 (High), assigned by Patchstack (Patchstack).

The vulnerability stems from improper validation of user-supplied input used to control file inclusion paths in PHP (CWE-98), allowing an attacker to manipulate the filename parameter passed to a PHP include or require statement. This enables inclusion of arbitrary local files from the server's filesystem. Exploitation requires no authentication (unauthenticated attacker) but does require user interaction — a privileged user must perform an action such as clicking a malicious link or visiting a crafted page. The attack is delivered over the network with high complexity (Patchstack).

Successful exploitation allows an attacker to include and expose the contents of arbitrary local files on the web server, including sensitive configuration files such as wp-config.php which contains database credentials. This could lead to complete database takeover, exposure of API keys and secrets, and potentially further compromise of the WordPress installation and underlying server depending on server configuration. Confidentiality, integrity, and availability are all rated as HIGH impact (Patchstack).

No public proof-of-concept exploit code has been identified at this time. The EPSS score is approximately 0.114%, indicating a low but non-negligible probability of exploitation in the near term. Patchstack classifies this as a high-priority vulnerability expected to be used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site traffic or popularity. There is no current evidence of active in-the-wild exploitation or CISA KEV catalog listing (Patchstack).

1. Reconnaissance: Identify WordPress sites running the Premmerce plugin version 1.3.19 or earlier using tools like WPScan, Shodan, or by inspecting plugin metadata in publicly accessible readme.txt files.
2. Craft malicious payload: Construct a URL or form submission that manipulates the vulnerable file inclusion parameter to reference a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd).
3. Deliver via social engineering: Since user interaction is required, craft a malicious link or page that causes a privileged WordPress user (e.g., admin) to trigger the vulnerable request — for example, by embedding the payload in a link sent via email or comment.
4. Retrieve file contents: Upon the privileged user triggering the request, the server includes and outputs the targeted local file, exposing its contents to the attacker.
5. Escalate access: Use exposed credentials (e.g., database credentials from wp-config.php) to access the database directly, escalate privileges, or pivot to further compromise the hosting environment (Patchstack).

• Network: HTTP requests to WordPress pages with unusual file path traversal sequences (e.g., ../, %2e%2e%2f) in query parameters or POST body fields associated with the Premmerce plugin.
• Logs: Web server access logs showing requests with path traversal patterns targeting Premmerce plugin endpoints; PHP error logs referencing unexpected file inclusion paths.
• File System: No direct file system artifacts expected from read-only LFI, but monitor for unexpected access to sensitive files like wp-config.php, /etc/passwd, or other configuration files.
• Process: Unusual database connection attempts from external IPs following potential credential exposure via wp-config.php disclosure.

The vulnerability is patched in Premmerce plugin version 1.3.20. Site administrators should update the plugin to version 1.3.20 or later immediately. Patchstack users benefit from a virtual patching/mitigation rule that blocks exploitation attempts until the plugin is updated. If immediate update is not possible, consult your hosting provider or web developer for assistance, and consider temporarily deactivating the plugin (Patchstack).