What is the CVSS score of CVE-2025-60203?

CVE-2025-60203 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Store Exporter are affected by CVE-2025-60203?

Store Exporter, a WooCommerce plugin used by e-commerce platforms, contains a local file inclusion vulnerability (CVE-2025-60203) that could allow attackers to read sensitive files or execute…

How to fix or mitigate CVE-2025-60203?

Within 24 hours: Identify all WooCommerce installations using Store Exporter and document current version numbers; disable the plugin if it is not business-critical. Within 7 days: Contact the plugin vendor for patch availability status and timeline; implement Web Application Firewall (WAF) rules to block LFI patterns targeting the plugin. Within 30 days: Evaluate alternative exporting solutions or monitor vendor advisories for a patch release; upgrade immediately upon availability and test thoroughly before production deployment.

Store Exporter CVE-2025-60203

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

WordPress LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Josh Kohlbach Store Exporter woocommerce-exporter allows PHP Local File Inclusion.This issue affects Store Exporter: from n/a through <= 2.7.6.

AnalysisAI

Local file inclusion in Store Exporter (WooCommerce plugin) through version 2.7.6 allows remote attackers with user interaction to read arbitrary files and potentially execute code via PHP file inclusion. Despite the 7.5 CVSS score, exploitation requires high attack complexity and user interaction, with an EPSS probability of only 0.08% (23rd percentile), indicating limited real-world exploitation likelihood. No active exploitation or public POC identified at time of analysis.

Technical ContextAI

CWE-98 (Improper Control of Filename for Include/Require Statement) represents a classic PHP file inclusion vulnerability where unsanitized user input is passed to PHP include/require functions. Store Exporter is a WordPress plugin for WooCommerce that exports store data. The vulnerability allows attackers to manipulate file path parameters to include arbitrary local files on the server. While classified as 'PHP Remote File Inclusion' in the description, the CVE title and Patchstack reference specifically identify this as Local File Inclusion (LFI), which is a critical distinction - LFI reads existing server files while RFI would execute remote attacker-controlled files. The plugin processes user-supplied filenames without proper validation before passing them to PHP file inclusion functions.

Affected ProductsAI

Store Exporter plugin for WordPress/WooCommerce, all versions through 2.7.6, developed by Josh Kohlbach. The vulnerability affects WordPress installations with WooCommerce and the Store Exporter plugin installed. Advisory and technical details available at Patchstack database (https://patchstack.com/database/Wordpress/Plugin/woocommerce-exporter/vulnerability/wordpress-store-exporter-plugin-2-7-6-local-file-inclusion-vulnerability). The specific starting version is not documented ('n/a through 2.7.6'), suggesting the vulnerability may have existed since the plugin's initial release.

RemediationAI

Update Store Exporter plugin to version 2.7.7 or later if available - verify current version at WordPress plugin repository or vendor website, as the Patchstack advisory does not explicitly confirm a patched release version. If a patched version is not yet available or cannot be immediately deployed, implement these compensating controls: (1) Disable the Store Exporter plugin entirely until patched, accepting the trade-off of losing export functionality; (2) Restrict WordPress admin access to trusted IP addresses via .htaccess or firewall rules, which limits attack surface but reduces operational flexibility for remote administrators; (3) Implement WordPress security plugins with file inclusion attack detection (e.g., Wordfence, Sucuri) to monitor and block suspicious file path manipulation attempts, though this adds performance overhead. Consult Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/woocommerce-exporter/vulnerability/wordpress-store-exporter-plugin-2-7-6-local-file-inclusion-vulnerability for vendor-specific guidance.