CVE-2025-60201
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The WordPress plugin WP Customer Area before version 8.3.4 contains a PHP Local File Inclusion (LFI) vulnerability due to improper control of filename for include/require statement. This allows an attacker to include local PHP files.
Risk Assessment
An attacker could read sensitive files on the server or execute malicious code, potentially leading to full compromise of the WordPress site.
Recommendation
Update the WP Customer Area plugin to version 8.3.4 or later. Additionally, regularly update all plugins and the WordPress core.
Other vulnerabilities in WP Customer Area
See all- CVE-2026-116854Medium
Subscriber Cross Site Scripting (XSS) in WP Customer Area <= 8.4.0 versions.
- CVE-2026-7640Medium
The WP Customer Area plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'type' attribute of the `customer-area-protected-content` shortcode in all versions up to, and including, 8.3.5. This is due to insufficient input sanitization and output escaping on the shortcode attribute.
- CVE-2026-42661High
The WP Customer Area plugin versions up to 8.3.4 contain a Path Traversal vulnerability, which may allow unauthorized access to system files.
Original NVD description (English source)
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in aguilatechnologies WP Customer Area customer-area allows PHP Local File Inclusion. This issue affects WP Customer Area: before 8.3.4.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS