PHP Remote File Inclusion Vulnerability in WooCommerce Store Toolkit by Josh Kohlbach

CVE-2025-60204

What is CVE-2025-60204?

The WooCommerce Store Toolkit, developed by Josh Kohlbach, contains a vulnerability allowing improper control over filenames during include or require statements. This flaw may permit attackers to achieve PHP Local File Inclusion, compromising the security of the affected WordPress installations. The vulnerability impacts all versions up to 2.4.3, highlighting the need for users to update and secure their systems to prevent unauthorized access and data breaches.

References