CVE-2025-60126
BaseFortify
Publication date: 2025-09-26
Last updated on: 2026-04-23
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| pluginops | testimonial_slider | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-98 | The PHP application receives input from an upstream component, but it does not restrict or incorrectly restricts the input before its usage in "require," "include," or similar functions. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an improper control of filename for include/require statements in the PluginOps Testimonial Slider PHP program, leading to a PHP Local File Inclusion issue. It allows an attacker to include local files on the server through the plugin, potentially executing malicious code.
How can this vulnerability impact me? :
The vulnerability can have a severe impact, including unauthorized access to sensitive files, execution of arbitrary code, and full compromise of the affected system. It has a high severity score indicating it can lead to confidentiality, integrity, and availability breaches.