The vulnerability identified as CVE-2025-60204 affects the WooCommerce Store Toolkit plugin by Josh Kohlbach. It is caused by improper validation or control of filenames used in PHP include or require statements, resulting in a Local File Inclusion vulnerability. This allows an attacker to potentially execute arbitrary code or access sensitive files on the affected system. The issue impacts versions up to and including 2.4.3. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor.

Successful exploitation of this vulnerability could lead to arbitrary code execution or unauthorized access to sensitive files on the server running the vulnerable WooCommerce Store Toolkit plugin. This compromises the confidentiality, integrity, and availability of the affected system. The high CVSS score reflects the serious nature of the impact. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to mitigate risk. Monitor official Josh Kohlbach or WooCommerce Store Toolkit advisories for updates and apply patches promptly once available.