CVE-2025-60150: Subscribe to Download Path Traversal Flaw

CVE-2025-60150 Overview

CVE-2025-60150 is a Local File Inclusion (LFI) vulnerability in the wpshuffle Subscribe to Download WordPress plugin. The flaw stems from improper control of filenames passed to PHP include/require statements, classified under [CWE-98]. All versions of subscribe-to-download up to and including 2.0.9 are affected.

Authenticated attackers with low privileges can manipulate file path parameters to include arbitrary local PHP files. Successful exploitation enables source code disclosure, sensitive data exposure, and potential remote code execution when combined with file upload primitives.

Critical Impact
Authenticated attackers can read arbitrary server files and execute PHP code by abusing dynamic file inclusion, leading to complete compromise of the WordPress site.

Affected Products

wpshuffle Subscribe to Download plugin for WordPress
All versions from n/a through 2.0.9 (inclusive)
WordPress installations using subscribe-to-download

Discovery Timeline

2025-09-26 - CVE-2025-60150 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-60150

Vulnerability Analysis

The vulnerability is a PHP Local File Inclusion classified under [CWE-98], Improper Control of Filename for Include/Require Statement in PHP Program. The Subscribe to Download plugin passes attacker-influenced input directly to a PHP file inclusion function without sufficient sanitization or allowlisting.

Attackers exploit this by supplying crafted path values that resolve to local files outside the plugin's intended scope. Because PHP executes any included file as code, the inclusion of attacker-controlled or attacker-readable files leads to information disclosure and code execution.

The CWE-98 weakness pattern frequently enables full server compromise on WordPress hosts. Combined with log poisoning, session file injection, or file upload features, the LFI converts into Remote Code Execution. EPSS data places exploitation probability at approximately 0.435% with a 34.46 percentile.

Root Cause

The root cause is unvalidated user input flowing into a PHP include, include_once, require, or require_once statement. The plugin trusts request parameters as part of a file path, lacking a strict allowlist of permitted template or module names. PHP's stream wrappers and relative path traversal further widen the inclusion surface.

Attack Vector

The attack vector is network-based and requires low-level authentication on the WordPress site. An attacker submits a crafted HTTP request to a Subscribe to Download endpoint containing a manipulated filename parameter. The vulnerable code concatenates this value into an inclusion call, causing PHP to load and execute the targeted file from the local filesystem.

No verified public exploit code is currently catalogued for CVE-2025-60150. Refer to the Patchstack WordPress Vulnerability Report for technical details.

Detection Methods for CVE-2025-60150

Indicators of Compromise

HTTP requests to Subscribe to Download endpoints containing path traversal sequences such as ../, ..%2f, or absolute paths like /etc/passwd.
Web server access logs showing repeated requests with php://, file://, or data:// stream wrapper prefixes in plugin parameters.
Unexpected PHP errors referencing include() or require() failures within wp-content/plugins/subscribe-to-download/.
Unauthorized WordPress administrator accounts or modified plugin/theme files following suspicious authenticated sessions.

Detection Strategies

Inspect WordPress request logs for parameter values containing filesystem paths, null bytes, or wrapper schemes targeting the plugin's AJAX or shortcode handlers.
Deploy file integrity monitoring across wp-content/, wp-includes/, and wp-config.php to detect unauthorized reads or modifications.
Correlate authenticated user activity with anomalous file access patterns originating from PHP-FPM or Apache workers.

Monitoring Recommendations

Enable Web Application Firewall (WAF) rules that block path traversal patterns and stream wrapper usage in WordPress plugin parameters.
Forward WordPress and webserver logs to a centralized SIEM and alert on requests targeting subscribe-to-download endpoints with suspicious parameter values.
Monitor outbound network connections from the PHP runtime for signs of post-exploitation command-and-control activity.

How to Mitigate CVE-2025-60150

Immediate Actions Required

Deactivate and remove the Subscribe to Download plugin until a fixed version is available and deployed.
Audit WordPress user accounts and revoke unnecessary subscriber, contributor, and author privileges that could be abused for authenticated exploitation.
Review web server and WordPress logs for prior exploitation attempts referencing the plugin endpoints.
Rotate WordPress secrets in wp-config.php, database credentials, and API keys if compromise is suspected.

Patch Information

No vendor patch is referenced in the available advisory data for versions beyond 2.0.9. Monitor the Patchstack WordPress Vulnerability Report and the official WordPress plugin repository for an updated release. Apply the fixed version as soon as it is published by wpshuffle.

Workarounds

Place a WAF rule in front of WordPress to block requests containing ../, encoded traversal sequences, or PHP stream wrapper prefixes targeting the plugin's endpoints.
Restrict PHP's open_basedir directive to confine file inclusion to the WordPress installation directory.
Disable PHP stream wrappers that are not required by setting allow_url_include=Off and allow_url_fopen=Off in php.ini.
Remove or restrict registration to limit the pool of low-privilege authenticated users who can reach the vulnerable code path.

bash

# php.ini hardening to limit LFI impact
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"