CVE-2025-60200

Name of the Vulnerable Software and Affected Versions LearnPress Export Import versions prior to 4.1.3

Description The LearnPress Export Import plugin for WordPress contains a Local File Inclusion issue. This occurs due to improper control of filenames used in include or require statements within the PHP program. Unauthenticated attackers can exploit this to include and execute arbitrary files on the server, potentially leading to the execution of PHP code, bypassing access controls, or obtaining sensitive data, especially if images or other safe file types can be uploaded and subsequently included.

Recommendations Update LearnPress Export Import to a version newer than 4.1.2.