CVE-2025-60078
HIGHCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Agence web Eoxia – Montpellier Task Manager task-manager allows PHP Local File Inclusion.This issue affects Task Manager: from n/a through <= 3.0.2.
Analysis
Local file inclusion (LFI) in Task Manager WordPress plugin versions ≤3.0.2 allows unauthenticated remote attackers to read arbitrary files from the server through improper filename control in PHP include/require statements. With a 7.5 CVSS score but only 0.06% EPSS (18th percentile), this represents high theoretical impact with low observed exploitation probability. No confirmed active exploitation (not in CISA KEV) or public exploit code identified at time of analysis. Patchstack security research disclosed this vulnerability affecting the Agence web Eoxia Task Manager plugin.
Technical Context
This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), commonly called PHP local/remote file inclusion. The flaw occurs when user-controllable input is passed unsanitized to PHP include(), require(), or similar functions that dynamically load files. While classified as 'PHP Remote File Inclusion' in the description, the tags and technical indicators suggest Local File Inclusion behavior, where attackers manipulate file path parameters to traverse the filesystem and include local files outside the intended directory scope. The Task Manager WordPress plugin (developed by Agence web Eoxia - Montpellier) fails to properly validate or sanitize filename parameters before processing them in PHP include/require operations. This allows path traversal sequences like '../../../' to escape restricted directories and access sensitive files such as wp-config.php, /etc/passwd, or other configuration files containing credentials and system information. The CVSS vector's High Confidentiality impact (C:H) with no Integrity or Availability impact confirms this is primarily an information disclosure vulnerability rather than a code execution scenario.
Affected Products
The vulnerability impacts Task Manager WordPress plugin developed by Agence web Eoxia - Montpellier, specifically all versions up to and including 3.0.2. The affected version range is documented as 'from n/a through 3.0.2', indicating the flaw exists in version 3.0.2 and likely earlier releases, though the initial vulnerable version is not specified in available data. This plugin provides task and project management functionality for WordPress installations. Users running Task Manager version 3.0.2 or earlier on WordPress sites are affected. The Patchstack vulnerability database entry provides additional context at https://patchstack.com/database/Wordpress/Plugin/task-manager/vulnerability/wordpress-task-manager-plugin-3-0-2-local-file-inclusion-vulnerability?_s_id=cve, though specific CPE identifiers were not provided in the available intelligence data.
Remediation
Administrators should immediately upgrade Task Manager plugin to a version newer than 3.0.2 that addresses this local file inclusion vulnerability. While the available data confirms the vulnerability affects versions through 3.0.2, the exact patched version number was not specified in the intelligence sources provided. Administrators should check the official plugin repository or vendor advisory for the latest secure release. As an immediate mitigation measure before patching, consider temporarily disabling the Task Manager plugin if not actively required for business operations. Review web server and WordPress access logs for suspicious requests containing path traversal patterns (../../, encoded variations like %2e%2e%2f, or attempts to access system files like wp-config.php or /etc/passwd) to identify potential exploitation attempts. Implement web application firewall rules to block requests with path traversal sequences targeting the plugin directory. After patching, verify that no configuration files or sensitive data were exposed by reviewing server logs from the period the vulnerability was present. Additional details and patching guidance available at the Patchstack advisory: https://patchstack.com/database/Wordpress/Plugin/task-manager/vulnerability/wordpress-task-manager-plugin-3-0-2-local-file-inclusion-vulnerability?_s_id=cve
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today