CVE-2025-60060
Published: 18 December 2025
Summary
CVE-2025-60060 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Axiomthemes Pubzinne. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 27.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-10 (Information Input Validation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires validation of user-supplied filenames prior to use in PHP include/require statements to prevent local file inclusion attacks.
Mandates timely identification, reporting, and correction of the specific LFI flaw in the Pubzinne WordPress theme up to version 1.0.12.
Enables vulnerability scanning to identify the PHP LFI vulnerability (CWE-98) in deployed WordPress themes like Pubzinne.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI/RFI vulnerability in public-facing WordPress theme directly enables exploitation of public-facing application for initial access, file disclosure, and potential RCE.
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in axiomthemes Pubzinne pubzinne allows PHP Local File Inclusion.This issue affects Pubzinne: from n/a through <= 1.0.12.
Deeper analysisAI
CVE-2025-60060 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion but enabling PHP Local File Inclusion, affecting the Pubzinne WordPress theme developed by axiomthemes. All versions of Pubzinne from n/a through 1.0.12 are vulnerable, as disclosed on December 18, 2025, and mapped to CWE-98.
The vulnerability carries a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating exploitation over the network by unauthenticated attackers without user interaction, though it demands high attack complexity. Attackers can achieve high impacts on confidentiality, integrity, and availability, potentially allowing local file disclosure or execution of arbitrary code through improper PHP include/require handling.
The Patchstack advisory at https://patchstack.com/database/Wordpress/Theme/pubzinne/vulnerability/wordpress-pubzinne-theme-1-0-12-local-file-inclusion-vulnerability?_s_id=cve details the local file inclusion flaw in Pubzinne version 1.0.12 for WordPress users.
Details
- CWE(s)