What is the CVSS score of CVE-2025-60074?

CVE-2025-60074 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Lazy Load Optimizer are affected by CVE-2025-60074?

The Lazy Load Optimizer WordPress plugin (versions ≤1.4.7) contains a local file inclusion vulnerability that could allow remote attackers to read sensitive files from affected web servers.

How to fix or mitigate CVE-2025-60074?

Within 24 hours: Identify all WordPress installations using Lazy Load Optimizer and document affected versions. Within 7 days: Disable or remove the plugin from all production environments if business-critical functionality allows; if retention is necessary, implement network-level access controls to restrict plugin endpoints. Within 30 days: Monitor vendor advisory channels for patch release and establish a deployment plan for version 1.4.8 or later when available.

Lazy Load Optimizer CVE-2025-60074

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:40 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Processby Lazy Load Optimizer lazy-load-optimizer allows PHP Local File Inclusion.This issue affects Lazy Load Optimizer: from n/a through <= 1.4.7.

AnalysisAI

Local file inclusion (LFI) in Lazy Load Optimizer WordPress plugin (versions through 1.4.7) allows remote unauthenticated attackers to read arbitrary files from the web server through improper PHP include/require statement handling. Despite the 7.5 CVSS score, exploitation requires high attack complexity and user interaction (AV:N/AC:H/PR:N/UI:R), limiting practical weaponization. EPSS score of 0.07% (22nd percentile) indicates very low probability of widespread exploitation. No active exploitation confirmed via CISA KEV, and no public exploit code identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), a class of PHP vulnerabilities where user-controlled input influences file paths passed to PHP's include(), require(), include_once(), or require_once() functions. Despite the CVE description mentioning 'PHP Remote File Inclusion' in parentheses, the vulnerability is tagged and classified as Local File Inclusion (LFI), meaning attackers can reference files already present on the server rather than remote URLs. The Lazy Load Optimizer plugin, designed to defer image loading for WordPress performance optimization, evidently fails to properly sanitize file path parameters before passing them to PHP include/require statements. This allows attackers to traverse the filesystem using path manipulation techniques (e.g., '../../../etc/passwd') to read sensitive files like configuration files, database credentials, or application source code. The WordPress plugin ecosystem's heavy reliance on dynamic PHP includes makes this vulnerability class particularly impactful when input validation is insufficient.

Affected ProductsAI

WordPress plugin Lazy Load Optimizer versions from earliest release through 1.4.7 inclusive, developed by Processby. The vulnerability was reported by Patchstack's security audit team, indicating discovery through third-party security research rather than vendor disclosure. Specific CPE data not provided in available intelligence. The plugin is distributed through the WordPress.org plugin repository for WordPress content management systems. Vendor advisory available at https://patchstack.com/database/Wordpress/Plugin/lazy-load-optimizer/vulnerability/wordpress-lazy-load-optimizer-plugin-1-4-7-local-file-inclusion-vulnerability.

RemediationAI

Upgrade Lazy Load Optimizer to version 1.4.8 or later if a patched version has been released by Processby (patch availability not independently confirmed from provided data - verify current version at WordPress.org plugin repository before deployment). If no patch is available or upgrade is not immediately feasible, SPECIFIC compensating controls include: (1) Disable the Lazy Load Optimizer plugin entirely until patch confirmation, accepting the performance trade-off of non-lazy-loaded images. (2) Implement web application firewall (WAF) rules to block requests containing path traversal sequences (../, ..\ , %2e%2e%2f, URL-encoded variants) targeted at plugin endpoints, though this may cause false positives with legitimate file paths. (3) Restrict WordPress administrative access to trusted IP ranges using .htaccess or server-level access controls, reducing the attack surface if exploitation requires authenticated contexts. (4) Enable PHP open_basedir restrictions to limit file access to the WordPress installation directory, preventing traversal to system files like /etc/passwd, though this may break other plugins with legitimate cross-directory access needs. Full advisory and technical details available at https://patchstack.com/database/Wordpress/Plugin/lazy-load-optimizer/vulnerability/wordpress-lazy-load-optimizer-plugin-1-4-7-local-file-inclusion-vulnerability.