What is the CVSS score of CVE-2025-60078?

CVE-2025-60078 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Task Manager (WordPress plugin) are affected by CVE-2025-60078?

The Task Manager WordPress plugin (versions ≤3.0.2) contains a local file inclusion vulnerability that allows authenticated users with low-privilege accounts to read sensitive files from web servers,…

How to fix or mitigate CVE-2025-60078?

Within 24 hours: Audit all WordPress installations for Task Manager plugin presence and current version via wp-cli or admin dashboard; document affected sites. Within 7 days: Disable or remove Task Manager plugin versions ≤3.0.2 on all affected systems; if the plugin is essential, restrict user role capabilities to prevent low-privilege account creation until patched. Within 30 days: Monitor vendor advisories for patched releases; test and deploy Task Manager plugin version >3.0.2 once available; review file access logs from affected systems for evidence of exploitation.

Task Manager (WordPress plugin) CVE-2025-60078

HIGH

PHP Remote File Inclusion (CWE-98)

2025-12-18 audit@patchstack.com

PHP LFI Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:15 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Apr 01, 2026 - 15:22 vuln.today

CVE Published

Dec 18, 2025 - 08:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Agence web Eoxia – Montpellier Task Manager task-manager allows PHP Local File Inclusion.This issue affects Task Manager: from n/a through <= 3.0.2.

AnalysisAI

Local file inclusion in Task Manager WordPress plugin versions ≤3.0.2 enables authenticated attackers with low privileges to read arbitrary files from the web server through improper filename control in PHP include/require statements. Exploitation requires network access with high attack complexity. EPSS score of 0.06% (18th percentile) indicates low probability of mass exploitation. No active exploitation confirmed in CISA KEV at time of analysis, though Patchstack vulnerability database documents this as a disclosed LFI vulnerability.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), commonly known as PHP Local File Inclusion. The flaw occurs when user-controlled input is passed to PHP include(), require(), include_once(), or require_once() functions without proper sanitization or path validation. Attackers can manipulate filename parameters to traverse directory structures (using ../ sequences) or reference sensitive system files. The vulnerability affects Task Manager, a WordPress plugin developed by Agence web Eoxia - Montpellier, through version 3.0.2. Unlike Remote File Inclusion (RFI), LFI exploits do not require allow_url_include to be enabled in PHP configuration, making them more reliably exploitable across diverse WordPress hosting environments.

Affected ProductsAI

Task Manager WordPress plugin versions from earliest release through 3.0.2 developed by Agence web Eoxia - Montpellier are confirmed vulnerable. The vulnerability database reference at Patchstack (https://patchstack.com/database/Wordpress/Plugin/task-manager/vulnerability/wordpress-task-manager-plugin-3-0-2-local-file-inclusion-vulnerability) provides technical details for affected installations. All WordPress sites running Task Manager plugin version 3.0.2 or earlier should be considered at risk.

RemediationAI

Immediately update Task Manager plugin to the latest patched version via WordPress admin dashboard or manually from the official WordPress plugin repository. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/task-manager/vulnerability/wordpress-task-manager-plugin-3-0-2-local-file-inclusion-vulnerability should be consulted for exact fixed version number and vendor remediation guidance. If immediate patching is not feasible, implement compensating controls: restrict WordPress user registration to prevent attacker account creation, audit and remove unnecessary low-privilege user accounts (subscribers, contributors), enforce strong password policies to prevent credential compromise, implement web application firewall rules to block directory traversal patterns (../, %2e%2e%2f, encoded variants) in requests to task-manager plugin endpoints, and monitor server logs for suspicious file access attempts to /etc/passwd, /wp-config.php, or Apache/nginx log files. Note that disabling the plugin entirely eliminates risk but removes task management functionality. File access logging may generate significant log volume in high-traffic environments.