Cyber Resilience

CVE-2025-60072

High

Published: 18 December 2025

Published
18 December 2025
Modified
27 April 2026
KEV Added
—
Patch
—
CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0042 32.9th percentile
Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-60072 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 32.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-60072 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, described as a PHP Remote File Inclusion issue that enables PHP Local File Inclusion, affecting the WordPress plugin Anchor Smooth Scroll by Processby. This flaw impacts all versions of the plugin from n/a through 1.0.2.

The vulnerability carries a CVSS v3.1 base score of 8.1 (High), with the vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. Unauthenticated remote attackers can exploit it over the network with high attack complexity and without requiring user interaction, potentially achieving high impacts on confidentiality, integrity, and availability through local file inclusion, such as arbitrary code execution.

Patchstack provides details on the vulnerability in its advisory at https://patchstack.com/database/Wordpress/Plugin/anchor-smooth-scroll/vulnerability/wordpress-anchor-smooth-scroll-plugin-1-0-2-local-file-inclusion-vulnerability?_s_id=cve, which security practitioners should consult for mitigation guidance related to the affected plugin versions.

EU & UK References

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Anchor smooth scroll anchor-smooth-scroll allows PHP Local File Inclusion.This issue affects Anchor smooth scroll: from n/a through <= 1.0.2.

CWE(s)
CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

The vulnerability is a remote file inclusion (RFI/LFI) flaw in a public-facing WordPress plugin, enabling unauthenticated attackers to achieve arbitrary code execution, directly mapping to exploitation of public-facing applications.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2025-60043Shared CWE-98
CVE-2026-22414Shared CWE-98
CVE-2025-69396Shared CWE-98
CVE-2026-22372Shared CWE-98
CVE-2025-67523Shared CWE-98
CVE-2025-53434Shared CWE-98
CVE-2026-27342Shared CWE-98
CVE-2026-22496Shared CWE-98
CVE-2025-49426Shared CWE-98
CVE-2025-49369Shared CWE-98

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly requires identification, reporting, and timely remediation of flaws such as this PHP LFI vulnerability in the Anchor Smooth Scroll WordPress plugin through patching or updates.

SI-10 Information Input Validation good match
prevent

Mandates validation of information inputs like filenames used in PHP include/require statements to block local file inclusion exploits.

SC-7 Boundary Protection partial match
preventdetect

Enforces boundary protection via web application firewalls or proxies to monitor and block network-based file inclusion attack payloads targeting this CVE.

References