What is the CVSS score of CVE-2025-60150?

CVE-2025-60150 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Subscribe to Download are affected by CVE-2025-60150?

The Subscribe to Download WordPress plugin (versions ≤2.0.9) contains a local file inclusion vulnerability that allows authenticated users with low privileges to read sensitive server files,…

How to fix or mitigate CVE-2025-60150?

Within 24 hours: Inventory all WordPress installations using Subscribe to Download plugin and document current versions. Within 7 days: Disable or remove the plugin if not actively required; if required, restrict plugin access to trusted administrator accounts only and implement Web Application Firewall rules based on Patchstack signatures. Within 30 days: Identify alternative plugins with current security maintenance, or contact the vendor for remediation timeline and apply any available security update immediately upon release.

Subscribe to Download CVE-2025-60150

HIGH

PHP Remote File Inclusion (CWE-98)

2025-09-26 audit@patchstack.com

LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:22 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:14 vuln.today

CVE Published

Sep 26, 2025 - 09:15 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpshuffle Subscribe to Download allows PHP Local File Inclusion. This issue affects Subscribe to Download: from n/a through 2.0.9.

AnalysisAI

Local file inclusion in Subscribe to Download WordPress plugin versions up to 2.0.9 allows authenticated attackers with low privileges to read arbitrary files on the server via manipulated PHP include paths. EPSS exploitation probability is low at 0.11% (29th percentile), and no active exploitation is confirmed in CISA KEV. The vulnerability requires authentication (PR:L) and high attack complexity (AC:H), limiting widespread exploitation risk despite the 7.5 CVSS score. Patchstack has documented this vulnerability, suggesting detection signatures exist for web application firewalls.

Technical ContextAI

This is a PHP local file inclusion (LFI) vulnerability classified as CWE-98 (Improper Control of Filename for Include/Require Statement). The WordPress plugin Subscribe to Download fails to properly sanitize user-controlled input before passing it to PHP include() or require() functions. While the CVE title mentions 'PHP Remote File Inclusion', the description and Patchstack reference confirm this is actually an LFI vulnerability, where attackers manipulate file paths to include local files rather than remote ones. The affected plugin is a WordPress component that gates content downloads behind email subscription forms. The vulnerability exists in all versions through 2.0.9, suggesting the insecure file handling has been present since the plugin's initial release.

Affected ProductsAI

WordPress plugin Subscribe to Download by wpshuffle, all versions from initial release through version 2.0.9. The vulnerability affects WordPress installations where this plugin is active and low-privilege users (subscriber level or higher) have accounts. Patchstack vulnerability database reference: https://patchstack.com/database/wordpress/plugin/subscribe-to-download/vulnerability/wordpress-subscribe-to-download-plugin-2-0-9-local-file-inclusion-vulnerability. No CPE string was provided in the source data, but the affected component is identifiable as the WordPress plugin with slug 'subscribe-to-download'.

RemediationAI

Update Subscribe to Download plugin to version 2.1.0 or later if available, though the exact patched version is not independently confirmed from available data. Check the WordPress plugin repository or wpshuffle vendor site for the latest secure release. As interim mitigation if no patch is deployed: restrict new user registrations to prevent attacker account creation, audit existing low-privilege user accounts (subscriber/contributor roles) for legitimacy and remove suspicious accounts, implement web application firewall rules to block common LFI attack patterns in requests to the plugin (consult Patchstack reference for signature details), and monitor web server logs for suspicious file access attempts to sensitive paths like wp-config.php or /etc/passwd. Note that restricting user roles will impact legitimate plugin functionality if subscribers are intended users. Complete plugin removal eliminates the vulnerability but breaks email-gated download functionality. Patchstack advisory: https://patchstack.com/database/wordpress/plugin/subscribe-to-download/vulnerability/wordpress-subscribe-to-download-plugin-2-0-9-local-file-inclusion-vulnerability.