What is the CVSS score of CVE-2025-60194?

CVE-2025-60194 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Premmerce Product Search are affected by CVE-2025-60194?

The Premmerce Product Search for WooCommerce plugin (versions ≤2.2.4) contains a local file inclusion vulnerability that allows attackers to read arbitrary server files, potentially exposing database…

How to fix or mitigate CVE-2025-60194?

Within 24 hours: Identify all WordPress installations running Premmerce Product Search for WooCommerce and document versions currently deployed. Within 7 days: Disable or remove the plugin entirely until a patched version is available; if disabling is not feasible, implement Web Application Firewall (WAF) rules to block requests targeting the vulnerable include/require functions. Within 30 days: Monitor vendor advisories for patch availability (target version >2.2.4); once released, test the patch in a staging environment and deploy to production, then re-enable the plugin only after validation.

Premmerce Product Search CVE-2025-60194

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

WordPress LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:35 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Premmerce Premmerce Product Search for WooCommerce premmerce-search allows PHP Local File Inclusion.This issue affects Premmerce Product Search for WooCommerce: from n/a through <= 2.2.4.

AnalysisAI

Local file inclusion in Premmerce Product Search for WooCommerce plugin versions ≤2.2.4 enables remote attackers to read arbitrary files on the server through improper filename control in PHP include/require statements. Exploitation requires high attack complexity and user interaction (AV:N/AC:H/UI:R), suggesting social engineering or specific application state needed to trigger the vulnerability. No active exploitation confirmed (EPSS 0.07%, not in CISA KEV), but represents significant risk for WordPress/WooCommerce sites running this plugin given potential exposure of sensitive configuration files, database credentials, and user data.

Technical ContextAI

This is a PHP Local File Inclusion (LFI) vulnerability classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The vulnerability occurs when user-controlled input is passed to PHP's include(), require(), or similar functions without proper sanitization, allowing an attacker to specify arbitrary file paths. In WordPress plugin context, this typically manifests in AJAX handlers, shortcode processors, or template loading mechanisms where file paths are constructed using unsanitized GET/POST parameters. The affected component is Premmerce Product Search for WooCommerce, a WordPress plugin that enhances WooCommerce product search functionality. Despite being labeled 'PHP Remote File Inclusion' in the vulnerability type name, the CVE correctly identifies this as LFI - RFI would require allow_url_include=On in PHP configuration, which is disabled by default in modern PHP installations. The CVSS vector indicates network-based exploitation (AV:N) but with high complexity (AC:H) and required user interaction (UI:R), suggesting the vulnerable code path is not directly accessible or requires specific application state/timing.

Affected ProductsAI

Premmerce Product Search for WooCommerce WordPress plugin versions from earliest release through 2.2.4 (inclusive) are confirmed vulnerable. The plugin integrates with WooCommerce e-commerce platform and is installed as a standard WordPress plugin. Affected installations must have both WordPress (any version supporting WooCommerce) and WooCommerce active, with the Premmerce Product Search plugin enabled. The vulnerability was reported by Patchstack's audit team (audit@patchstack.com), and complete technical details are available in the Patchstack vulnerability database at https://patchstack.com/database/Wordpress/Plugin/premmerce-search/vulnerability/wordpress-premmerce-product-search-for-woocommerce-plugin-2-2-4-local-file-inclusion-vulnerability.

RemediationAI

Immediately update Premmerce Product Search for WooCommerce to version 2.2.5 or later if available, checking the WordPress plugin repository or vendor website for the patched release. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/premmerce-search/vulnerability/wordpress-premmerce-product-search-for-woocommerce-plugin-2-2-4-local-file-inclusion-vulnerability should confirm fixed version numbers. If no patched version exists or immediate patching is not feasible, implement these compensating controls: (1) Deactivate and remove the Premmerce Product Search plugin entirely, reverting to WooCommerce's native search functionality - this eliminates attack surface with minimal functionality impact for most use cases; (2) Implement Web Application Firewall (WAF) rules blocking requests containing directory traversal sequences (../, ..\ , %2e%2e%2f) and null bytes (%00) in parameters sent to the plugin's endpoints, though this may cause false positives and does not address all LFI attack vectors; (3) Restrict file system permissions to prevent the web server user (www-data, apache, nginx) from reading sensitive files outside the WordPress installation directory, specifically denying read access to /etc/passwd, /etc/shadow, system logs, and adjacent virtual host configurations - note this defense-in-depth measure may break legitimate functionality if the plugin requires reading files outside its directory; (4) Enable PHP's open_basedir directive to restrict file operations to the WordPress installation path, preventing access to system files, though this server-level change may impact other applications on shared hosting.