What is the CVSS score of CVE-2025-60153?

CVE-2025-60153 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Subscribe To Unlock are affected by CVE-2025-60153?

A local file inclusion vulnerability in Subscribe To Unlock WordPress plugin (versions up to 1.1.5) permits low-privileged authenticated users to execute arbitrary PHP code, risking unauthorized data…

How to fix or mitigate CVE-2025-60153?

Within 24 hours: Audit installed WordPress plugins and identify any instances of Subscribe To Unlock version 1.1.5 or earlier using admin dashboard or WP-CLI. Within 7 days: Disable or deactivate the plugin pending vendor patch release; document any dependent functionality and plan replacement. Within 30 days: Monitor official plugin repository for patch release; implement access controls limiting authenticated user capabilities to prevent privilege escalation; conduct code review of any custom integrations with the plugin.

Subscribe To Unlock CVE-2025-60153

HIGH

PHP Remote File Inclusion (CWE-98)

2025-09-26 audit@patchstack.com

LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 01:21 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:14 vuln.today

CVE Published

Sep 26, 2025 - 09:15 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in wpshuffle Subscribe To Unlock allows PHP Local File Inclusion. This issue affects Subscribe To Unlock: from n/a through 1.1.5.

AnalysisAI

Local file inclusion in Subscribe To Unlock WordPress plugin versions up to 1.1.5 allows authenticated attackers with low privileges to include and execute arbitrary PHP files on the server, potentially leading to remote code execution, sensitive data disclosure, or full site compromise. EPSS score of 0.11% (29th percentile) indicates low probability of mass exploitation. No public exploit code or active exploitation confirmed at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), commonly known as PHP Local File Inclusion (LFI). Despite the CVE description mentioning 'PHP Remote File Inclusion' in the vulnerability class name, the tags and actual vulnerability type confirm this is LFI. The WordPress plugin Subscribe To Unlock fails to properly validate user-supplied input used in PHP include/require statements, allowing authenticated users to manipulate file paths. In PHP applications, insufficient sanitization of file path parameters can enable attackers to include arbitrary local files, which may contain sensitive configuration data (wp-config.php, .htaccess), log files with session tokens, or uploaded files containing malicious PHP code. When combined with file upload capabilities or log poisoning techniques, LFI can escalate to remote code execution as the webserver process user.

Affected ProductsAI

Subscribe To Unlock WordPress plugin versions from earliest available release through 1.1.5 are confirmed vulnerable per Patchstack database. The plugin is identified by WordPress slug 'subscribe-to-unlock'. Organizations running WordPress sites with this plugin installed in any version up to and including 1.1.5 should prioritize assessment, particularly those allowing low-privilege user registrations (subscriber, contributor roles). The Patchstack advisory at https://patchstack.com/database/wordpress/plugin/subscribe-to-unlock/vulnerability/wordpress-subscribe-to-unlock-plugin-1-1-5-local-file-inclusion-vulnerability provides complete affected version details.

RemediationAI

Update Subscribe To Unlock plugin to version 1.1.6 or later if available, or remove the plugin entirely if not business-critical. Verify patch availability and version number at the WordPress plugin repository or the Patchstack advisory (https://patchstack.com/database/wordpress/plugin/subscribe-to-unlock/vulnerability/wordpress-subscribe-to-unlock-plugin-1-1-5-local-file-inclusion-vulnerability). If immediate patching is not feasible, implement these compensating controls with noted trade-offs: Disable or uninstall the Subscribe To Unlock plugin until patched (eliminates attack surface but removes functionality); restrict WordPress user roles to only trusted administrators, removing subscriber and contributor accounts (reduces PR:L attack vector but may conflict with site's user engagement model); implement Web Application Firewall rules to block requests with path traversal patterns (../, .\, file://) in parameters sent to the plugin's endpoints (may cause false positives for legitimate file operations); enable PHP open_basedir restrictions to limit file inclusion scope to WordPress directories only (defense-in-depth measure but won't prevent inclusion of sensitive files within allowed paths like wp-config.php). Monitor WordPress access logs for unusual file parameter values and failed authentication attempts to low-privilege accounts.