What is the CVSS score of CVE-2025-60204?

CVE-2025-60204 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of WooCommerce Store Toolkit are affected by CVE-2025-60204?

WooCommerce Store Toolkit plugin (versions ≤2.4.3) contains a local file inclusion vulnerability that could allow attackers to read sensitive files from WordPress servers through network-based…

How to fix or mitigate CVE-2025-60204?

Within 24 hours: Identify all WordPress instances running WooCommerce Store Toolkit plugin and document installed versions via admin dashboard or WP-CLI; disable the plugin if version ≤2.4.3 until patch availability is confirmed. Within 7 days: Contact WooCommerce/plugin vendor for patch timeline; implement Web Application Firewall (WAF) rules to block suspicious filename parameter patterns in WooCommerce Store Toolkit requests; review server access logs for exploitation attempts (focus on unusual file path requests). Within 30 days: Establish plugin inventory and version management process; evaluate alternative plugins with active maintenance records; implement file integrity monitoring on WordPress configuration and sensitive directories.

WooCommerce Store Toolkit CVE-2025-60204

HIGH

PHP Remote File Inclusion (CWE-98)

2025-11-06 audit@patchstack.com

WordPress LFI PHP Information Disclosure

7.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 24, 2026 - 00:29 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Apr 23, 2026 - 15:43 vuln.today

cvss_changed

Analysis Generated

Mar 28, 2026 - 19:20 vuln.today

CVE Published

Nov 06, 2025 - 16:16 nvd

HIGH 7.5

DescriptionCVE.org

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Josh Kohlbach WooCommerce Store Toolkit woocommerce-store-toolkit allows PHP Local File Inclusion.This issue affects WooCommerce Store Toolkit: from n/a through <= 2.4.3.

AnalysisAI

Local file inclusion in WooCommerce Store Toolkit plugin versions up to 2.4.3 allows network-based attackers to read arbitrary files from the WordPress server via improper filename control in PHP include/require statements. Despite network-based attack vector (AV:N), the vulnerability requires high attack complexity and user interaction (AC:H/UI:R), limiting exploitation scenarios. EPSS score of 0.08% (23rd percentile) suggests low likelihood of widespread exploitation in the wild. No CISA KEV listing or public POC identified at time of analysis, though Patchstack has documented the vulnerability.

Technical ContextAI

This vulnerability stems from CWE-98 (Improper Control of Filename for Include/Require Statement) in PHP code. The WooCommerce Store Toolkit WordPress plugin fails to properly sanitize user-controllable input used in PHP include() or require() statements, allowing path traversal sequences to reference local files outside the intended directory. Despite being categorized as PHP Remote File Inclusion in the description, the CVE ID and tags confirm this is actually Local File Inclusion (LFI). WordPress plugins are particularly susceptible to this class of vulnerability when processing user-supplied parameters for dynamic file inclusion without adequate validation or whitelisting. The affected plugin extends WooCommerce functionality for store management and toolkit operations.

Affected ProductsAI

WooCommerce Store Toolkit WordPress plugin versions from earliest release through 2.4.3 inclusive are confirmed vulnerable. This plugin by Josh Kohlbach provides store management and bulk operations functionality for WooCommerce-powered WordPress sites. The vulnerability affects all installations running version 2.4.3 or earlier. Patchstack has published vulnerability details at https://patchstack.com/database/Wordpress/Plugin/woocommerce-store-toolkit/vulnerability/wordpress-woocommerce-store-toolkit-plugin-2-4-3-local-file-inclusion-vulnerability.

RemediationAI

Update WooCommerce Store Toolkit to version 2.4.4 or later if available, per Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/woocommerce-store-toolkit/vulnerability/wordpress-woocommerce-store-toolkit-plugin-2-4-3-local-file-inclusion-vulnerability. If patched version is not yet released or immediate update is not feasible, disable the WooCommerce Store Toolkit plugin entirely until patch availability is confirmed, trading toolkit functionality for security. Implement Web Application Firewall rules to block path traversal sequences in HTTP parameters (../, ..\, URL-encoded variants) targeting the plugin directory, though this provides incomplete protection as sophisticated attackers may bypass pattern matching. Restrict WordPress admin access to trusted IP ranges and enforce multi-factor authentication to reduce likelihood of successful social engineering required for UI:R component. Monitor WordPress file integrity and audit logs for unauthorized file access attempts to wp-config.php or other sensitive configuration files.