CVE-2025-60190
📋 TL;DR
This CVE describes a PHP Local File Inclusion vulnerability in the Immocaster WordPress plugin that allows attackers to include arbitrary local files via improper filename control. Attackers can potentially read sensitive files or execute code on affected WordPress sites. All WordPress installations using Immocaster plugin versions up to and including 1.3.6 are vulnerable.
💻 Affected Systems
- Immocaster WordPress Plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise through remote code execution leading to data theft, website defacement, or malware deployment.
Likely Case
Sensitive file disclosure (configuration files, database credentials) and limited code execution within web server context.
If Mitigated
No impact if proper file permissions and web server hardening prevent file inclusion outside web root.
🎯 Exploit Status
Simple file inclusion attacks are well-documented and easy to automate. Public exploit details exist in security advisories.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.3.7 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Immocaster plugin. 4. Click 'Update Now' if update available. 5. If no update available, deactivate and remove plugin immediately.
🔧 Temporary Workarounds
Disable Immocaster Plugin
allDeactivate the vulnerable plugin to prevent exploitation
wp plugin deactivate immocaster
Restrict PHP File Functions
linuxModify php.ini to disable dangerous functions
disable_functions = include,require,include_once,require_once
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block file inclusion patterns
- Restrict web server permissions to prevent reading sensitive files outside web root
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Immocaster version. If version <= 1.3.6, vulnerable.Check Version:
wp plugin get immocaster --field=versionVerify Fix Applied:
Verify Immocaster plugin version is 1.3.7 or later, or plugin is completely removed.📡 Detection & Monitoring
Log Indicators:
- Unusual file include requests in PHP error logs
- Requests with suspicious file paths containing ../ patterns
Network Indicators:
- HTTP requests with file inclusion parameters to immocaster endpoints
SIEM Query:
source="web_server_logs" AND (uri="*immocaster*" AND (params="*include*" OR params="*require*" OR params="*../*"))