CVE-2025-60126
Published: 26 September 2025
Summary
CVE-2025-60126 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 35.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates CVE-2025-60126 by identifying, patching, and deploying fixes for the LFI flaw in Testimonial Slider plugin versions through 3.5.8.6.
Prevents exploitation of the improper filename control in PHP include/require by validating inputs to the testimonial-add component against malicious local file paths.
Restricts filename inputs to the vulnerable testimonial-add endpoint to safe, whitelisted values, blocking LFI path traversal by low-privileged remote attackers.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
LFI in public-facing WordPress PHP plugin directly enables remote exploitation of web apps (T1190) and arbitrary code execution via included scripts or web shells (T1059.004, T1100).
NVD Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginOps Testimonial Slider testimonial-add allows PHP Local File Inclusion.This issue affects Testimonial Slider: from n/a through <= 3.5.8.6.
Deeper analysisAI
CVE-2025-60126 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, known as PHP Remote File Inclusion, in the testimonial-add component of the PluginOps Testimonial Slider WordPress plugin. It enables PHP Local File Inclusion and affects all versions from n/a through 3.5.8.6. The issue is associated with CWE-98 and was published on 2025-09-26.
The vulnerability carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Low-privileged users can exploit it remotely with low attack complexity and no user interaction, potentially achieving high impacts on confidentiality, integrity, and availability through local file inclusion.
The Patchstack advisory provides details on this local file inclusion vulnerability in WordPress Testimonial Slider plugin version 3.5.8.6, available at https://patchstack.com/database/Wordpress/Plugin/testimonial-add/vulnerability/wordpress-testimonial-slider-plugin-3-5-8-6-local-file-inclusion-vulnerability?_s_id=cve.
Details
- CWE(s)