What is the CVSS score of CVE-2025-60191?

CVE-2025-60191 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Premmerce Wishlist for WooCommerce are affected by CVE-2025-60191?

A local file inclusion vulnerability in Premmerce Wishlist for WooCommerce (versions ≤1.1.10) could allow attackers to read arbitrary PHP files from affected WordPress sites, posing a risk to…

How to fix or mitigate CVE-2025-60191?

Within 24 hours: Inventory all WordPress installations using Premmerce Wishlist for WooCommerce and identify those running version 1.1.10 or earlier. Within 7 days: Contact the plugin vendor (Premmerce) directly to confirm patch availability and timeline, and disable the plugin on affected systems if no update is available. Within 30 days: Update to the patched version once released by the vendor, or implement a Web Application Firewall (WAF) rule to block malicious file inclusion attempts targeting the vulnerable plugin.

Premmerce Wishlist for WooCommerce CVE-2025-60191

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

WordPress LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:38 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Wishlist for WooCommerce premmerce-woocommerce-wishlist allows PHP Local File Inclusion.This issue affects Premmerce Wishlist for WooCommerce: from n/a through <= 1.1.10.

AnalysisAI

Local file inclusion in Premmerce Wishlist for WooCommerce plugin ≤1.1.10 enables network attackers to read arbitrary PHP files and potentially execute code through crafted include/require statements. The vulnerability requires high attack complexity and user interaction (CVSS AC:H/UI:R), limiting practical exploitability. EPSS score of 0.07% (22nd percentile) indicates low likelihood of mass exploitation, and no active exploitation is documented in CISA KEV. Patchstack has documented this vulnerability, suggesting security researcher disclosure rather than in-the-wild discovery.

Technical ContextAI

This is a PHP Local File Inclusion (LFI) vulnerability, classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The flaw occurs when a WordPress plugin fails to properly sanitize user-controlled input before passing it to PHP include(), require(), include_once(), or require_once() functions. In WordPress environments, this typically manifests through improper handling of URL parameters, POST data, or file paths that influence which PHP files are dynamically loaded. While categorized as 'PHP Remote File Inclusion' in the title, the technical reality based on the 'LFI' tag is Local File Inclusion - attackers can force the application to include local files from the server filesystem rather than remote URLs (which would require allow_url_include to be enabled in PHP). The vulnerability affects all versions through 1.1.10 of the premmerce-woocommerce-wishlist WordPress plugin, which extends WooCommerce with wishlist functionality.

Affected ProductsAI

Premmerce Wishlist for WooCommerce (WordPress plugin identifier: premmerce-woocommerce-wishlist) versions from earliest release through 1.1.10 inclusive are confirmed vulnerable. This plugin extends WooCommerce e-commerce functionality with customer wishlist features and is distributed through the WordPress plugin repository. The vulnerability was reported by Patchstack's security audit team (audit@patchstack.com), and detailed information is available in the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Plugin/premmerce-woocommerce-wishlist/vulnerability/wordpress-premmerce-wishlist-for-woocommerce-plugin-1-1-10-local-file-inclusion-vulnerability. All WordPress sites running WooCommerce with this specific wishlist plugin installed at version 1.1.10 or earlier should be considered affected.

RemediationAI

Update Premmerce Wishlist for WooCommerce to the latest version above 1.1.10 through the WordPress admin dashboard (Plugins → Installed Plugins → locate premmerce-woocommerce-wishlist → click Update) or via WP-CLI command 'wp plugin update premmerce-woocommerce-wishlist'. Verify the updated version number post-installation. Consult the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/premmerce-woocommerce-wishlist/vulnerability/wordpress-premmerce-wishlist-for-woocommerce-plugin-1-1-10-local-file-inclusion-vulnerability for specific patched version confirmation, as NVD data does not provide the exact fix version. If immediate patching is not feasible, implement compensating controls: disable the Premmerce Wishlist plugin entirely until patching (breaks wishlist functionality for customers, acceptable for non-critical e-commerce features), restrict WordPress admin access to trusted IP ranges via .htaccess or firewall rules (reduces attack surface but limits legitimate remote administration), enable WordPress application firewall rules through security plugins like Wordfence or Sucuri to filter malicious include patterns (may cause false positives requiring tuning), and monitor web server error logs for suspicious file path traversal attempts containing '../' sequences or references to /etc/passwd and system files (detective control only, does not prevent exploitation). Review server PHP configuration to ensure allow_url_include is disabled (php.ini setting), which prevents escalation from LFI to Remote File Inclusion if attackers find bypass techniques.