Local File Inclusion Vulnerability in ThimPress LearnPress Plugin
CVE-2025-60200

7.5HIGH

Key Information:

Vendor

WordPress
Status
Learnpress Export Import
Vendor
CVE Published:
6 November 2025

What is CVE-2025-60200?

A vulnerability in the ThimPress LearnPress Export Import plugin allows an improper control on filename inclusion and requires PHP settings, leading to local file inclusion attacks. This security flaw permits unauthorized remote access to potentially sensitive files on the server, thereby posing risks to web applications using this plugin version up to 4.0.9. It is essential for users to update their installations and review security configurations to mitigate exposure.

Affected Version(s)

LearnPress Export Import <= n/a

References

https://vdp.patchstack.com/database/Wordpress/Plugin/lear...
vdb-entry

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

LVT-tholv2k | Patchstack Bug Bounty Program
JSON
.