What is the CVSS score of CVE-2025-60192?

CVE-2025-60192 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Premmerce Wholesale Pricing for WooCommerce are affected by CVE-2025-60192?

CVE-2025-60192 affects Premmerce Wholesale Pricing for WooCommerce plugin versions 1.1.10 and earlier, enabling local file inclusion attacks that could expose sensitive business data or allow code…

How to fix or mitigate CVE-2025-60192?

Within 24 hours: inventory all WordPress instances running Premmerce Wholesale Pricing plugin and document current versions via admin dashboard or WP-CLI. Within 7 days: contact Premmerce support to confirm patch availability timeline and interim mitigation options; disable the plugin on non-critical test sites if no patch exists. Within 30 days: apply vendor-released patch immediately upon availability to all production instances, or migrate to alternative wholesale pricing solutions if Premmerce does not issue a patch.

Premmerce Wholesale Pricing for WooCommerce CVE-2025-60192

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

WordPress LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:37 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Wholesale Pricing for WooCommerce premmerce-woocommerce-wholesale-pricing allows PHP Local File Inclusion.This issue affects Premmerce Wholesale Pricing for WooCommerce: from n/a through <= 1.1.10.

AnalysisAI

Local File Inclusion in Premmerce Wholesale Pricing for WooCommerce plugin (versions ≤1.1.10) allows remote attackers to read arbitrary files and potentially execute PHP code through improper filename validation. Despite the CVSS 7.5 score, real-world risk is moderate: attack complexity is high (AC:H) and requires user interaction (UI:R), limiting opportunistic exploitation. EPSS score of 0.07% (22nd percentile) suggests low probability of widespread exploitation. No active exploitation confirmed (not in CISA KEV) and public exploit code has not been identified at time of analysis.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement), commonly known as PHP Local File Inclusion. The plugin fails to properly sanitize user-supplied input used in PHP include() or require() statements, allowing attackers to manipulate file paths. While classified as 'PHP Remote File Inclusion' in the description, Patchstack tags indicate this is actually Local File Inclusion (LFI). The vulnerability affects the Premmerce Wholesale Pricing plugin for WooCommerce, a WordPress e-commerce extension used for managing bulk pricing tiers. The flaw likely exists in administrative or frontend endpoints that dynamically include files based on request parameters without adequate validation or sanitization of directory traversal sequences.

Affected ProductsAI

Premmerce Wholesale Pricing for WooCommerce WordPress plugin versions from earliest release through 1.1.10 are confirmed vulnerable. This affects WordPress installations running WooCommerce with the Premmerce wholesale pricing extension installed and activated. The vulnerability exists in the plugin's core file inclusion logic regardless of specific WordPress or WooCommerce versions. Patchstack advisory available at https://patchstack.com/database/Wordpress/Plugin/premmerce-woocommerce-wholesale-pricing/vulnerability/wordpress-premmerce-wholesale-pricing-for-woocommerce-plugin-1-1-10-local-file-inclusion-vulnerability provides additional technical details.

RemediationAI

Immediately update Premmerce Wholesale Pricing for WooCommerce to version 1.1.11 or later if available, checking the WordPress plugin repository or vendor site for the patched release. Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/premmerce-woocommerce-wholesale-pricing/vulnerability/wordpress-premmerce-wholesale-pricing-for-woocommerce-plugin-1-1-10-local-file-inclusion-vulnerability should confirm exact fix version. If no patch is immediately available, implement compensating controls: disable and deactivate the plugin until patched version is released (trade-off: wholesale pricing functionality lost); restrict plugin access to only trusted administrator accounts via WordPress role management; implement Web Application Firewall rules to block requests containing directory traversal patterns (../, %2e%2e%2f) in parameters passed to plugin endpoints (trade-off: may cause false positives with legitimate file operations); enable WordPress debug logging to detect exploitation attempts. Review server access logs for suspicious requests targeting plugin paths with traversal sequences as indicators of compromise.