Immocaster Vulnerabilities

[en] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Hinnerk Altenburg Immocaster WordPress Plugin immocaster allows PHP Local File Inclusion.This issue affects Immocaster WordPress Plugin: from n/a through <= 1.3.6.

Affected:

up to 1.3.6

Fix:

No patched version reported

Disclosed:

Nov 6, 2025

CVE-2025-60190 on NVD →

The Immocaster WordPress plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 1.3.6. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access...

CVSS:

8.1

Affected:

up to 1.3.6

Fix:

No patched version reported

Disclosed:

Jul 28, 2025

CVE-2025-60190 on NVD →