CVE-2025-60153 Overview
CVE-2025-60153 is a Local File Inclusion (LFI) vulnerability in the wpshuffle Subscribe To Unlock WordPress plugin. The flaw stems from improper control of filename parameters used in PHP include or require statements [CWE-98]. Affected versions include all releases of subscribe-to-unlock up to and including 1.1.5. Authenticated attackers with low-privilege access can abuse the vulnerable parameter handling to load arbitrary local PHP files on the server. Successful exploitation impacts confidentiality, integrity, and availability of the WordPress installation. The vulnerability was published to the National Vulnerability Database (NVD) on September 26, 2025.
Critical Impact
Attackers can include arbitrary local PHP files through the plugin, leading to sensitive information disclosure and potential code execution on WordPress sites running Subscribe To Unlock 1.1.5 or earlier.
Affected Products
- wpshuffle Subscribe To Unlock plugin for WordPress
- All versions from n/a through <= 1.1.5
- WordPress sites with the subscribe-to-unlock plugin installed and active
Discovery Timeline
- 2025-09-26 - CVE-2025-60153 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-60153
Vulnerability Analysis
The Subscribe To Unlock plugin fails to properly sanitize user-supplied input passed to a PHP file inclusion statement. This category of weakness is tracked as [CWE-98]: Improper Control of Filename for Include/Require Statement in PHP Program. While the CVE title references PHP Remote File Inclusion, the documented impact in this case is Local File Inclusion (LFI), meaning attackers can reference files already present on the host filesystem.
An authenticated user can manipulate a request parameter that is concatenated into an include, require, include_once, or require_once call. The plugin does not enforce an allow-list of permitted files or sanitize directory traversal sequences such as ../. As a result, the PHP interpreter loads and executes the targeted file in the context of the WordPress process.
Impact extends to disclosure of configuration files such as wp-config.php, log file contents, and any local PHP file accessible to the web server user. When combined with file upload primitives, LFI can escalate to remote code execution.
Root Cause
The root cause is the absence of input validation on a filename parameter consumed by a PHP file inclusion function. The plugin trusts attacker-controlled input as a path component without canonicalization or restriction to a fixed directory.
Attack Vector
The attack vector is network-based and requires low privileges on the target WordPress site. An authenticated user sends a crafted HTTP request to the vulnerable plugin endpoint with a manipulated filename parameter. The PHP runtime then includes the referenced file, executing any PHP contained within it. No user interaction is required. See the Patchstack WordPress Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-60153
Indicators of Compromise
- HTTP requests to subscribe-to-unlock plugin endpoints containing directory traversal sequences such as ../ or absolute filesystem paths.
- Web server access logs showing requests with suspicious filename parameters referencing wp-config.php, /etc/passwd, or PHP files outside the plugin directory.
- Unexpected PHP error log entries referencing include() or require() failures with attacker-controlled paths.
Detection Strategies
- Inspect WordPress access logs for parameter values containing .., null bytes (%00), or PHP wrappers like php://filter.
- Deploy Web Application Firewall (WAF) rules that block LFI patterns targeting WordPress plugin endpoints.
- Correlate authenticated session activity with anomalous file inclusion attempts originating from low-privilege accounts.
Monitoring Recommendations
- Monitor file integrity on wp-config.php and other sensitive files for unauthorized reads or modifications.
- Alert on outbound connections initiated by the PHP-FPM or web server process to untrusted destinations.
- Track plugin version inventory across WordPress hosts to identify installations of Subscribe To Unlock at or below version 1.1.5.
How to Mitigate CVE-2025-60153
Immediate Actions Required
- Deactivate and remove the Subscribe To Unlock plugin until a patched release is available.
- Audit WordPress user accounts and revoke unused low-privilege accounts that could be leveraged for exploitation.
- Rotate WordPress credentials, database passwords, and any secrets stored in wp-config.php if exploitation is suspected.
Patch Information
No fixed version is listed in the available advisory data. The vulnerability affects Subscribe To Unlock through version 1.1.5. Monitor the Patchstack advisory and the WordPress plugin repository for an updated release.
Workarounds
- Restrict access to the WordPress admin interface using IP allow-lists or VPN-only access controls.
- Configure PHP open_basedir to limit file inclusion to the WordPress installation directory.
- Apply WAF virtual patching rules that block requests containing directory traversal patterns to plugin endpoints.
# Example PHP open_basedir restriction in php.ini
open_basedir = "/var/www/html/wordpress:/tmp"
# Disable allow_url_include to prevent remote file inclusion escalation
allow_url_include = Off
allow_url_fopen = Off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
