CVE-2025-60201

WP Customer Area’s code contains an include/require call that fails to sanitize user‑supplied filenames, resulting in a PHP Local File Inclusion flaw. An attacker who can influence the include parameter can read arbitrary files from the server or trigger execution of PHP code, thereby compromising the confidentiality, integrity, or availability of the WordPress site. The weakness resides strictly within the plugin’s file inclusion logic and does not automatically lead to privilege escalation, but successful exploitation can provide the attacker with full control over the application and potentially the underlying server.

The vulnerability affects the WordPress plugin WP Customer Area developed by Aguila Technologies. All installations that use any plugin version from the earliest release up through 8.3.5 are susceptible. There are no known changes to the affected range beyond these versions.

The CVSS score of 7.5 indicates a high severity risk, while the EPSS score of less than 1% suggests the probability of exploitation is currently low. Because the flaw resides in a publicly accessible WordPress plugin, an attacker can potentially exploit it without prior authentication, relying on crafted HTTP requests that manipulate the include path. The scenario is not listed in the CISA Known Exploited Vulnerabilities catalog, so no confirmed field‑deployed exploits are reported at this time. Nonetheless, the high CVSS and the nature of the flaw make the vulnerability a priority for remediation.