What is the CVSS score of CVE-2025-60126?

CVE-2025-60126 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Testimonial Slider are affected by CVE-2025-60126?

The Testimonial Slider WordPress plugin (versions ≤3.5.8.6) contains a local file inclusion vulnerability that permits any registered user to execute arbitrary PHP code on your website, risking…

How to fix or mitigate CVE-2025-60126?

Within 24 hours: Identify all WordPress sites using Testimonial Slider plugin and document affected versions via admin dashboard or WP-CLI (wp plugin list). Within 7 days: Disable or remove Testimonial Slider plugin; audit user access logs for suspicious activity from registered accounts, particularly those with contributor or editor roles. Within 30 days: Evaluate alternative testimonial plugins with active maintenance; restore from clean backups if any post-exploitation artifacts are found; implement Web Application Firewall (WAF) rules to restrict file inclusion patterns as interim control.

Testimonial Slider CVE-2025-60126

HIGH

PHP Remote File Inclusion (CWE-98)

2025-09-26 audit@patchstack.com

LFI PHP Information Disclosure

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:23 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:14 vuln.today

CVE Published

Sep 26, 2025 - 09:15 nvd

HIGH 8.8

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in PluginOps Testimonial Slider allows PHP Local File Inclusion. This issue affects Testimonial Slider: from n/a through 3.5.8.6.

AnalysisAI

Local File Inclusion in Testimonial Slider WordPress plugin allows authenticated attackers with low-level privileges to include and execute arbitrary PHP files on the server, potentially leading to remote code execution, information disclosure, or complete site compromise. All versions through 3.5.8.6 are affected. The vulnerability requires only low-privilege authentication (PR:L) and has network attack vector (AV:N) with low complexity (AC:L), making it readily exploitable by registered users. EPSS score of 0.14% indicates low predicted exploitation probability in the wild, and no active exploitation or public POC has been identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), commonly known as Local File Inclusion (LFI). In PHP applications, particularly WordPress plugins, LFI occurs when user-controlled input is passed unsanitized to file inclusion functions like include(), require(), include_once(), or require_once(). The Testimonial Slider plugin (WordPress identifier: testimonial-add) fails to properly validate or sanitize file path parameters, allowing attackers to manipulate the filename argument to traverse directories using path sequences (../) or directly specify absolute paths to include arbitrary PHP files. Despite the CVE description mentioning 'PHP Remote File Inclusion,' the tags and Patchstack classification confirm this is Local File Inclusion. LFI vulnerabilities in WordPress plugins typically occur in AJAX handlers, template loading mechanisms, or admin panel file operations where developers trust authenticated user input.

Affected ProductsAI

Testimonial Slider WordPress plugin (slug: testimonial-add) developed by PluginOps is affected in all versions from earliest release through version 3.5.8.6. The vulnerability impacts WordPress installations where this plugin is active and users with subscriber-level or higher privileges exist. Patchstack advisory available at https://patchstack.com/database/wordpress/plugin/testimonial-add/vulnerability/wordpress-testimonial-slider-plugin-3-5-8-6-local-file-inclusion-vulnerability provides detailed vulnerability information but no CPE identifiers were provided in the available data.

RemediationAI

Immediately update Testimonial Slider plugin to version 3.5.8.7 or later if available, verified through the WordPress plugin repository or vendor advisory at https://patchstack.com/database/wordpress/plugin/testimonial-add/vulnerability/wordpress-testimonial-slider-plugin-3-5-8-6-local-file-inclusion-vulnerability. If no patched version exists, implement compensating controls: disable the Testimonial Slider plugin until a fix is released, restrict user registration to prevent untrusted low-privilege account creation (Settings → General → Membership in WordPress admin), audit existing subscriber and contributor accounts for legitimacy, implement Web Application Firewall (WAF) rules to detect path traversal sequences in HTTP requests targeting the plugin endpoints, and monitor server logs for suspicious file access patterns. Note that disabling user registration may impact legitimate site functionality requiring user accounts. As a defense-in-depth measure, configure PHP disable_functions directive to restrict dangerous functions like system(), exec(), and passthru() if LFI leads to code execution, though this may break other plugin functionality and should be tested in staging first.