What is the CVSS score of CVE-2025-60193?

CVE-2025-60193 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Premmerce User Roles are affected by CVE-2025-60193?

A local file inclusion vulnerability in Premmerce User Roles WordPress plugin (versions ≤1.0.13) could allow attackers to read sensitive files and potentially execute code, but requires high…

How to fix or mitigate CVE-2025-60193?

Within 24 hours: Inventory all WordPress installations using Premmerce User Roles plugin and document current versions. Within 7 days: If versions ≤1.0.13 are confirmed in use, disable or remove the plugin; evaluate alternative user role management solutions. Within 30 days: Complete migration to a maintained alternative plugin or implement application-level file access controls if the plugin is business-critical and cannot be replaced immediately.

Premmerce User Roles CVE-2025-60193

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:36 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce User Roles premmerce-user-roles allows PHP Local File Inclusion.This issue affects Premmerce User Roles: from n/a through <= 1.0.13.

AnalysisAI

Local file inclusion in Premmerce User Roles WordPress plugin ≤1.0.13 allows remote attackers to read arbitrary files and potentially execute code via improper validation of include/require file paths. Attack requires high complexity and user interaction (CVSS AC:H/UI:R), limiting practical exploitation. EPSS score of 0.07% (22nd percentile) indicates very low observed exploitation probability in the wild. No CISA KEV listing or public POC identified. Patchstack security audit disclosed this vulnerability, affecting all versions up to 1.0.13.

Technical ContextAI

This vulnerability stems from CWE-98 (PHP Remote File Inclusion), though the description classifies it as Local File Inclusion. The flaw occurs when PHP's include() or require() statements accept unsanitized user input to construct file paths. In WordPress plugin architecture, this typically manifests when plugins dynamically include template files, library components, or language files based on GET/POST parameters or cookie values without proper path traversal validation (e.g., allowing '../' sequences) or whitelisting allowed filenames. Affected product is WordPress plugin 'premmerce-user-roles' versions through 1.0.13. The contradiction between CVE title (Remote File Inclusion) and NVD tags (Local File Inclusion/LFI) suggests the vulnerability allows reading local server files rather than including remote malicious code, though the CVSS vector (AV:N) confirms network-based exploitation.

Affected ProductsAI

WordPress plugin Premmerce User Roles (premmerce-user-roles) versions from earliest release through version 1.0.13 inclusive are vulnerable. The plugin provides role-based access control functionality for WordPress e-commerce sites. Vendor advisory and patch details available at Patchstack database: https://patchstack.com/database/Wordpress/Plugin/premmerce-user-roles/vulnerability/wordpress-premmerce-user-roles-plugin-1-0-13-local-file-inclusion-vulnerability. No CPE identifier provided in available data. Plugin is distributed through WordPress.org repository for WooCommerce-based stores.

RemediationAI

Update Premmerce User Roles plugin to version 1.0.14 or later if available (patched version not independently confirmed from provided data; consult Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/premmerce-user-roles/vulnerability/wordpress-premmerce-user-roles-plugin-1-0-13-local-file-inclusion-vulnerability for exact fix version). If immediate patching is not feasible, implement compensating controls: disable the Premmerce User Roles plugin entirely if not business-critical (eliminates attack surface but removes role management functionality); restrict WordPress admin access to trusted IP ranges via .htaccess or firewall rules (reduces UI:R attack vector but impacts legitimate remote administration); enable WordPress file modification restrictions via wp-config.php define('DISALLOW_FILE_EDIT', true) to limit impact of successful exploitation (prevents weaponization to persistent backdoor but doesn't prevent initial file disclosure). Web Application Firewall rules blocking path traversal patterns (../, %2e%2e%2f) in requests to /wp-content/plugins/premmerce-user-roles/ may provide defense-in-depth but could cause false positives with legitimate plugin operations.