{"id":87052,"date":"2026-06-06T00:21:38","date_gmt":"2026-06-06T00:21:38","guid":{"rendered":""},"modified":"-0001-11-30T00:00:00","modified_gmt":"-0001-11-30T00:00:00","slug":"cve-2025-60150-php-remote-file-inclusion-vulnerability-in-subscribe-to-download-wordpress-plugin","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-60150-php-remote-file-inclusion-vulnerability-in-subscribe-to-download-wordpress-plugin\/","title":{"rendered":"CVE-2025-60150: PHP Remote File Inclusion Vulnerability in Subscribe to Download WordPress Plugin<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

This report highlights the critical security vulnerability, CVE-2025-60150, which impacts the Subscribe to Download plugin on the WordPress platform. This PHP Remote File Inclusion vulnerability can lead to significant breaches, potentially compromising entire systems and leading to severe data leakage. It is crucial to address this issue due to the high-risk score and broad user base of the affected plugin.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-60150
\nSeverity: High (7.5 CVSS Score)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: Required
\nImpact: System compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Subscribe to Download | n\/a through 2.0.9<\/p>\n

How the Exploit Works<\/strong><\/p>\n

The vulnerability stems from an improper control of the filename for include\/require statements in the PHP program of wpshuffle’s Subscribe to Download plugin. This issue allows for PHP Local File Inclusion (LFI), meaning an attacker can trick the script into including files from remote servers, leading to code execution. This execution could potentially compromise the system or lead to data leakage.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a conceptual example of how this vulnerability might be exploited. This might be a part of a malicious HTTP request:<\/p>\n

GET \/wp-content\/plugins\/subscribe-to-download\/download.php?file=..\/..\/..\/..\/..\/..\/..\/etc\/passwd HTTP\/1.1\nHost: vulnerablewebsite.com<\/code><\/pre>\n
In this example, the attacker is attempting to access the ‘passwd’ file, a common target due to its sensitive data. By manipulating the ‘file’ parameter in the GET request, the attacker can traverse the directory tree to access files outside of the intended directory.<\/p>\n
Countermeasures<\/strong><\/p>\n
The best mitigation strategy is to apply the vendor patch as soon as it becomes available. If the patch is not yet available, using a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation. Additionally, disable the plugin if it’s not immediately necessary, until the patch is issued. Regularly monitoring system logs for any unusual activity is also recommended.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview This report highlights the critical security vulnerability, CVE-2025-60150, which impacts the Subscribe to Download plugin on the WordPress platform. This PHP Remote File Inclusion vulnerability can lead to significant breaches, potentially compromising entire systems and leading to severe data leakage. It is crucial to address this issue due to the high-risk score and broad […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[],"tags":[],"vendor":[],"product":[],"attack_vector":[],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-87052","post","type-post","status-publish","format-standard","hentry"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t