CVE-2025-60190

High

Published: 06 November 2025

Published

06 November 2025

Modified

27 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.1 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score 0.0012 31.1th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-60190 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 31.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-60190 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability, classified as PHP Remote File Inclusion, in the Immocaster WordPress Plugin developed by Hinnerk Altenburg. The flaw enables PHP Local File Inclusion and affects the immocaster plugin from its initial version (n/a) through version 1.3.6. Published on 2025-11-06, it carries a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-98.

A network-based attacker requires no privileges or user interaction but must overcome high attack complexity to exploit the vulnerability remotely. Successful exploitation grants high-impact access to confidentiality, integrity, and availability, potentially allowing the attacker to include and execute arbitrary local PHP files on the server.

The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/immocaster/vulnerability/wordpress-immocaster-wordpress-plugin-plugin-1-3-6-local-file-inclusion-vulnerability?_s_id=cve provides further details on the vulnerability, including mitigation recommendations.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2025-38125

Vulnerability details

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hinnerk Altenburg Immocaster WordPress Plugin immocaster allows PHP Local File Inclusion.This issue affects Immocaster WordPress Plugin: from n/a through <= 1.3.6.

CWE(s): CWE-98

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

The vulnerability is a PHP Remote/Local File Inclusion in a public-facing WordPress plugin, directly enabling exploitation of a public-facing application for remote code execution.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0