CVE-2025-60196CWE-98

CVE-2025-60196

High · published November 6, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
39.0
In the wild
Unconfirmed
What it is

⚡ An improper control of file inclusion in the Clearblue Ovulation Calculator could let a crafty attacker read any file they want! 🔍💻 Think of it like a restaurant that accepts any dish request without checking the recipe book. If a waiter doesn't verify orders, someone could sneak in a dish that shouldn't be served, leading to all sorts of chaos in the kitchen! This vulnerability allows attackers to include files from the server, which could lead to the exposure of sensitive information or, surprisingly, even execute code. In the worst-case scenario, they could gain access to anything from user data to configuration files, wreaking havoc in your system. This could be absolutely devastating for users relying on this calculator for important decisions!

Put simply

Think of it like a restaurant that accepts any dish request without checking the recipe book. If a waiter doesn't verify orders, someone could sneak in a dish that shouldn't be served, leading to all sorts of chaos in the kitchen! This PHP Remote File Inclusion vulnerability allows unauthorized file access by failing to properly validate file paths. Specifically, it targets Clearblue Ovulation Calculator versions 1.2.4 and earlier, giving attackers a way to include malicious scripts or retrieve sensitive files.

What to do

This vulnerability allows attackers to include files from the server, which could lead to the exposure of sensitive information or, surprisingly, even execute code. In the worst-case scenario, they could gain access to anything from user data to configuration files, wreaking havoc in your system. This could be absolutely devastating for users relying on this calculator for important decisions! To secure your application, immediately patch Clearblue Ovulation Calculator to version 1.2.5 or higher. Additionally, implement strict validation on file paths to ensure only authorized files can be included. Regularly audit your codebase for similar vulnerabilities to keep your application secure. You've got this! Follow these steps, and you’ll turn this vulnerability into just a memory! 🛡️✨

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00461 · 39.0th percentile
Weakness
CWE-98 · Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion')
Published
2025-11-06T21:16Z
References (1)
EPSS history
Timeline
  • 06 NOV 15:54Z
    WordPress Clearblue® Ovulation Calculator plugin <= 1.2.4 - Local File Inclusion vulnerability
    cvelistv5