What is the CVSS score of CVE-2025-60197?

CVE-2025-60197 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Simple Contact Forms are affected by CVE-2025-60197?

The Simple Contact Forms WordPress plugin (versions ≤1.6.4) contains a local file inclusion vulnerability allowing unauthenticated remote attackers to read arbitrary files from the server,…

Simple Contact Forms CVE-2025-60197

Q: How to fix or mitigate CVE-2025-60197?

Within 24 hours: Identify all WordPress installations using Simple Contact Forms plugin and document current versions via admin dashboard or wp-cli. Within 7 days: Disable or remove Simple Contact Forms plugin if not actively required; if required, implement Web Application Firewall (WAF) rules to block requests containing path traversal patterns (../, etc.) to the plugin's include directory. Within 30 days: Monitor Patchstack and WordPress.org plugin repository for patch release; upon availability, immediately update to patched version and re-enable if previously disabled.

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

8.1

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:33 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

CVSS changed

Apr 23, 2026 - 15:43 NVD

8.2 (HIGH) 8.1 (HIGH)

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 8.2

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in owenr88 Simple Contact Forms simple-contact-forms allows PHP Local File Inclusion.This issue affects Simple Contact Forms: from n/a through <= 1.6.4.

AnalysisAI

Local File Inclusion in Simple Contact Forms WordPress plugin (versions ≤1.6.4) allows remote unauthenticated attackers to include arbitrary PHP files from the server's local filesystem via improper filename validation in include/require statements. CVSS rates this 8.1 (High) with high attack complexity (AC:H), but EPSS indicates only 0.08% exploitation probability (23rd percentile), suggesting low real-world targeting. Patchstack classified this as an LFI vulnerability with information disclosure potential, though successful exploitation could escalate to code execution if combined with file upload or log poisoning techniques.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), a class of weaknesses where PHP applications dynamically construct file paths for include() or require() statements using unsanitized user input. The Simple Contact Forms WordPress plugin fails to properly validate filenames passed to PHP file inclusion functions, allowing attackers to manipulate path traversal sequences or reference local files. Unlike Remote File Inclusion (RFI) which requires allow_url_include enabled, Local File Inclusion (LFI) works against default PHP configurations, making it a more universally exploitable condition. The plugin processes contact form submissions in PHP, and vulnerable code likely exists in form handling or template rendering logic where user-controlled parameters influence file paths without adequate sanitization or whitelist validation.

Affected ProductsAI

The vulnerability affects Simple Contact Forms, a WordPress plugin developed by owenr88, in all versions up to and including 1.6.4. The version range begins from an unspecified early release (marked 'n/a' in advisories) through version 1.6.4. This is a WordPress ecosystem plugin available through the official WordPress.org repository. The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/simple-contact-forms/vulnerability/wordpress-simple-contact-forms-plugin-1-6-4-local-file-inclusion-vulnerability) provides the authoritative affected version information, though no CPE string was provided in NVD data for precise product identification.

RemediationAI

Immediately upgrade Simple Contact Forms to version 1.6.5 or later if available from the WordPress plugin repository. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/simple-contact-forms/vulnerability/wordpress-simple-contact-forms-plugin-1-6-4-local-file-inclusion-vulnerability should be consulted for official patch confirmation and release notes. If a patched version is not yet available or upgrade is delayed, implement these compensating controls with noted trade-offs: (1) Deactivate and remove the Simple Contact Forms plugin entirely, replacing with an alternative contact form solution (disrupts contact functionality until replacement configured). (2) Implement Web Application Firewall (WAF) rules to block requests containing path traversal sequences (../, .\, %2e%2e%2f) in parameters passed to the plugin, though sophisticated attackers may bypass pattern-based filters using encoding tricks. (3) Restrict PHP open_basedir directive in php.ini or .htaccess to limit file inclusion scope to WordPress installation directory only (may break legitimate plugins with cross-directory dependencies). (4) Enable PHP disable_functions for potentially dangerous functions like include, require, include_once if application logic permits (high risk of breaking WordPress core and other plugins).