CVE-2025-60126: Testimonial Slider LFI Vulnerability

CVE-2025-60126 Overview

CVE-2025-60126 is a Local File Inclusion (LFI) vulnerability in the PluginOps Testimonial Slider WordPress plugin. The flaw stems from improper control of filenames used in PHP include or require statements within the testimonial-add functionality [CWE-98]. Authenticated attackers with low privileges can supply crafted input to load arbitrary local PHP files on the server. Successful exploitation can lead to code execution, credential disclosure, and full site compromise. The issue affects Testimonial Slider versions up to and including 3.5.8.6.

Critical Impact
An authenticated attacker can include arbitrary local PHP files, leading to remote code execution and complete compromise of confidentiality, integrity, and availability on affected WordPress installations.

Affected Products

PluginOps Testimonial Slider WordPress plugin
All versions through 3.5.8.6
WordPress sites with the testimonial-add component enabled

Discovery Timeline

2025-09-26 - CVE-2025-60126 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-60126

Vulnerability Analysis

The Testimonial Slider plugin processes user-controllable input inside the testimonial-add handler and passes it into a PHP file inclusion routine. Because the plugin does not validate or sanitize the supplied filename against an allowlist, the include path can be redirected to attacker-chosen files on the local filesystem. This category of weakness is tracked as [CWE-98], improper control of filename for include or require statements in PHP. Although the CVE record cites both PHP Remote File Inclusion and Local File Inclusion semantics, the realized impact described is LFI through the same code path.

Root Cause

The root cause is missing input validation on a parameter that flows directly into a PHP include or require call. The plugin trusts request-supplied data as a filename fragment without enforcing a fixed base directory, stripping path traversal sequences, or validating extensions. Any authenticated user able to reach the testimonial-add endpoint can manipulate this parameter.

Attack Vector

The vulnerability is exploitable over the network and requires only low-privilege authentication with no user interaction. An attacker submits a crafted request to the testimonial-add endpoint with a manipulated filename parameter referencing a local file such as wp-config.php or an uploaded PHP payload. When the include statement executes, the targeted file is parsed and executed in the web server context, yielding code execution under the WordPress process identity.

No verified public proof-of-concept code is available. Refer to the Patchstack WordPress Vulnerability Report for advisory-level technical detail.

Detection Methods for CVE-2025-60126

Indicators of Compromise

Unexpected access log entries to testimonial-add endpoints containing path traversal sequences such as ../, ..%2f, or null byte variants.
Web server processes spawning shells, curl, or wget originating from the WordPress php-fpm or httpd worker.
New or modified PHP files in wp-content/uploads/ or other writable plugin directories.
Outbound connections from the web server to unfamiliar hosts shortly after a testimonial-add request.

Detection Strategies

Inspect WordPress and web server access logs for requests targeting the Testimonial Slider plugin with suspicious file path parameters.
Apply web application firewall rules that block traversal patterns and absolute paths in plugin request parameters.
Monitor file integrity on the WordPress installation, focusing on wp-config.php, plugin directories, and the uploads folder.

Monitoring Recommendations

Alert on PHP worker processes invoking interpreters or shell utilities, which is anomalous in normal WordPress operation.
Track authenticated WordPress sessions that generate elevated volumes of plugin-administrative requests.
Forward WordPress and reverse proxy logs to a centralized analytics platform and retain them for incident review.

How to Mitigate CVE-2025-60126

Immediate Actions Required

Update the Testimonial Slider plugin to a version released after 3.5.8.6 as soon as a fixed release is published.
If no patched version is yet available, deactivate and remove the plugin from production WordPress sites.
Rotate WordPress secrets in wp-config.php, database credentials, and any API tokens reachable from the web root, assuming exposure.
Audit all administrative and contributor accounts and revoke unused low-privilege accounts that could reach the testimonial-add endpoint.

Patch Information

No fixed version is identified in the published advisory at the time of writing. Monitor the Patchstack WordPress Vulnerability Report for vendor release information.

Workarounds

Restrict access to WordPress authoring roles and enforce multi-factor authentication to limit who can reach the vulnerable endpoint.
Deploy a virtual patching rule at the web application firewall that blocks path traversal and absolute path values in plugin parameters.
Configure PHP open_basedir to confine includes to the WordPress installation directory, reducing the file scope reachable through LFI.
Set the uploads directory to disallow PHP execution via web server configuration to limit pairing of LFI with file upload primitives.

bash

# Example nginx configuration: block PHP execution in uploads and constrain includes
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
}

# php.ini hardening
# open_basedir = /var/www/html/wordpress:/tmp
# allow_url_include = Off
# allow_url_fopen = Off