The vulnerability CVE-2025-60150 affects the wpshuffle Subscribe to Download plugin for WordPress, specifically versions up to 2.0.9. It arises from improper control of the filename parameter in PHP include or require statements, resulting in a Local File Inclusion vulnerability. This can enable an attacker with low privileges to include arbitrary files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector and high attack complexity.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to read sensitive files, execute arbitrary code, or disrupt service. The impact is rated high due to potential compromise of confidentiality, integrity, and availability of the affected system. No known exploits in the wild have been reported to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once released.