What is the CVSS score of CVE-2025-60190?

CVE-2025-60190 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Immocaster WordPress Plugin are affected by CVE-2025-60190?

The Immocaster WordPress plugin (versions ≤1.3.6) contains a local file inclusion vulnerability that could allow attackers to read sensitive server files or execute code, affecting any WordPress…

How to fix or mitigate CVE-2025-60190?

Within 24 hours: Inventory all WordPress installations using Immocaster plugin and document current versions. Within 7 days: Disable or remove the Immocaster plugin from production environments if not critical to operations; if required, implement Web Application Firewall (WAF) rules to block file inclusion parameter manipulation and restrict file access via .htaccess or web server configuration. Within 30 days: Monitor Patchstack and WordPress.org plugin repository for security updates; establish a process to patch immediately upon vendor release; consider alternative plugins with active security maintenance.

Immocaster WordPress Plugin CVE-2025-60190

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

WordPress LFI PHP Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:39 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 8.1

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hinnerk Altenburg Immocaster WordPress Plugin immocaster allows PHP Local File Inclusion.This issue affects Immocaster WordPress Plugin: from n/a through <= 1.3.6.

AnalysisAI

Local File Inclusion in Immocaster WordPress Plugin versions through 1.3.6 enables remote attackers to read arbitrary files on the server or potentially execute code by manipulating file inclusion parameters. Despite the high CVSS score of 8.1, EPSS data indicates only 0.08% exploitation probability (23rd percentile), suggesting limited active targeting. No active exploitation confirmed by CISA KEV, though Patchstack's disclosure indicates researcher awareness. Attack complexity is rated High (AC:H), requiring specific server configurations or precise timing to exploit successfully.

Technical ContextAI

This vulnerability stems from improper validation of file paths in PHP include/require statements (CWE-98), a classic file inclusion flaw affecting WordPress plugins. The Immocaster plugin, developed by Hinnerk Altenburg for real estate listing management, fails to sanitize user-controlled input before passing it to PHP file inclusion functions. While classified as 'PHP Remote File Inclusion' in the description, Patchstack tags it as Local File Inclusion (LFI), indicating the vulnerability likely allows reading local files rather than including remote URLs. This discrepancy may reflect PHP configuration dependencies - allow_url_include settings determine whether remote file inclusion is possible. The affected component appears to be core plugin functionality handling file operations, typical in WordPress plugins managing media or template files for property listings.

Affected ProductsAI

Immocaster WordPress Plugin versions 1.3.6 and earlier, developed by Hinnerk Altenburg. The vulnerability affects all installations from the plugin's initial release through version 1.3.6. Specific WordPress version compatibility not documented in available data, though typical WordPress plugins support WordPress 5.0+. CPE data not provided in intelligence sources. Vendor advisory and technical details available through Patchstack database at https://patchstack.com/database/Wordpress/Plugin/immocaster/vulnerability/wordpress-immocaster-wordpress-plugin-plugin-1-3-6-local-file-inclusion-vulnerability.

RemediationAI

Immediately upgrade Immocaster WordPress Plugin to a version newer than 1.3.6 if available from the plugin repository or vendor. Patchstack disclosure suggests a fix may exist, though exact patched version number is not confirmed in provided intelligence - verify current version status at WordPress.org plugin directory or contact plugin author Hinnerk Altenburg directly. If no patched version is released, implement these compensating controls: (1) Disable the Immocaster plugin entirely if not actively required for business operations, preventing all exploitation; (2) Restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules to limit attack surface, though this reduces usability for legitimate administrators; (3) Verify PHP configuration has allow_url_include set to Off (PHP 5.2.0+ default) to prevent remote file inclusion escalation, though local file disclosure remains possible; (4) Implement Web Application Firewall rules blocking common LFI patterns like '../', 'php://', 'file://', and null bytes in parameters, which may cause false positives for legitimate file operations. Monitor web server logs for suspicious file path traversal attempts targeting the plugin directory. Full technical remediation guidance available at https://patchstack.com/database/Wordpress/Plugin/immocaster/vulnerability/wordpress-immocaster-wordpress-plugin-plugin-1-3-6-local-file-inclusion-vulnerability.