What is the CVSS score of CVE-2025-60202?

CVE-2025-60202 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Favorites are affected by CVE-2025-60202?

The WordPress Favorites plugin through version 2.3.6 contains a local file inclusion vulnerability (CVE-2025-60202) that could allow attackers to read sensitive files from affected servers, requiring…

How to fix or mitigate CVE-2025-60202?

Within 24 hours: Inventory all WordPress installations using the Favorites plugin and document current versions. Within 7 days: Contact the plugin vendor for patch timeline and consider disabling the plugin if no patch is available; apply the patch immediately upon release. Within 30 days: Implement a Web Application Firewall (WAF) rule to block LFI attack patterns targeting the Favorites plugin until patching is complete.

Favorites CVE-2025-60202

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Kyle Phillips Favorites favorites allows PHP Local File Inclusion.This issue affects Favorites: from n/a through <= 2.3.6.

AnalysisAI

Local File Inclusion in WordPress Favorites plugin versions through 2.3.6 enables network-based attackers to read arbitrary files from the server's filesystem through crafted PHP include statements. Despite the CWE-98 classification suggesting remote file inclusion, the vulnerability title and tags confirm this is actually an LFI attack requiring user interaction (UI:R) and high attack complexity (AC:H). EPSS score of 0.08% (23rd percentile) indicates low probability of mass exploitation, and no active exploitation or public POC has been identified at time of analysis.

Technical ContextAI

This is a PHP Local File Inclusion vulnerability in the WordPress Favorites plugin by Kyle Phillips. The flaw stems from improper validation of filename parameters passed to PHP include/require statements (CWE-98). While CWE-98 is categorized as 'PHP Remote File Inclusion', the actual exploitation path here is local file inclusion as confirmed by the Patchstack classification and LFI tag. The plugin fails to sanitize user-supplied input before using it in file path construction for include/require operations, allowing attackers to traverse the directory structure using path manipulation sequences. The CVSS vector AV:N indicates the vulnerability is exploitable over the network despite requiring local file access, suggesting the attack leverages web-accessible endpoints to read local files. The plugin is distributed through the WordPress plugin repository and affects versions up to and including 2.3.6.

Affected ProductsAI

WordPress Favorites plugin by Kyle Phillips versions from earliest release through 2.3.6 are confirmed vulnerable. The plugin is identified in the WordPress plugin ecosystem with slug 'favorites'. Specific CPE data was not provided, but the vulnerability affects all WordPress installations running the plugin in the specified version range. Patchstack has documented this vulnerability with database entry available at https://patchstack.com/database/Wordpress/Plugin/favorites/vulnerability/wordpress-favorites-plugin-2-3-6-local-file-inclusion-vulnerability.

RemediationAI

Upgrade to Favorites plugin version 2.3.7 or later if available, though the exact patched version is not confirmed in provided data - site administrators should check the WordPress plugin repository or Patchstack advisory for the latest secure release. If immediate patching is not feasible, implement these specific compensating controls: disable the Favorites plugin entirely until patching is completed, as functionality loss is preferable to file disclosure risk; restrict plugin file access using web server directives to block direct requests to plugin PHP files except through WordPress core routing; enable PHP open_basedir restrictions in php.ini or .htaccess to limit file access to WordPress installation directories only (side effect: may break plugins using absolute paths outside WordPress root); implement Web Application Firewall rules blocking requests containing directory traversal sequences like '../' or encoded equivalents in parameters passed to the plugin (side effect: may cause false positives if legitimate use cases involve file path parameters). Review advisory at https://patchstack.com/database/Wordpress/Plugin/favorites/vulnerability/wordpress-favorites-plugin-2-3-6-local-file-inclusion-vulnerability for vendor-specific guidance.