What is the CVSS score of CVE-2025-60201?

CVE-2025-60201 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of PHP are affected by CVE-2025-60201?

WP Customer Area plugin versions 8.2.7 and earlier contain a local file inclusion vulnerability that could allow attackers to read sensitive files from affected WordPress servers.

How to fix or mitigate CVE-2025-60201?

Within 24 hours: Inventory all WordPress installations using WP Customer Area plugin and document current versions. Within 7 days: Disable or remove WP Customer Area plugin versions 8.2.7 and earlier; if the plugin is business-critical, upgrade to version 8.2.8 or later once released, or implement file access controls (see compensating controls). Within 30 days: Establish a monitoring process for WP Customer Area security advisories and configure automated plugin update notifications.

PHP CVE-2025-60201

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:31 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in aguilatechnologies WP Customer Area customer-area allows PHP Local File Inclusion.This issue affects WP Customer Area: from n/a through <= 8.2.7.

AnalysisAI

Local File Inclusion in WP Customer Area plugin version 8.2.7 and earlier allows remote attackers to read arbitrary files on the server through improper validation of file paths in PHP include/require statements. The attack requires high complexity and user interaction (CVSS AC:H/UI:R), limiting widespread exploitation. EPSS score of 0.08% indicates low observed exploitation probability. No active exploitation confirmed in CISA KEV, though Patchstack has cataloged this vulnerability in their WordPress security database.