CVE-2025-24733

Executive Summary

CVE-2025-24733 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the WordPress plugin Post Grid Master (by Addonmaster, slug: ajax-filter-posts). The vulnerability resides in the improper control of filenames used in PHP include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The vulnerability affects all versions up to and including 3.4.12. No patch has been confirmed at the time of analysis.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who have installed the plugin via the WordPress admin dashboard or via direct download are at risk. The plugin is not distributed via NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• CVSS Score: 6.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is rated Medium due to the high confidentiality impact but no direct impact on integrity or availability. However, in a real-world scenario, LFI can often be chained with other vulnerabilities (e.g., file upload) to achieve remote code execution, significantly raising the risk.

Deep Dive & Mechanics

The vulnerability exists in the ajax-filter-posts plugin's PHP code, specifically in how it handles filenames for include/require statements. The plugin likely uses user-supplied input (e.g., via a GET or POST parameter) to construct a file path for inclusion without proper sanitization or validation. An attacker can manipulate this parameter to traverse directories and include arbitrary files from the server.

Example vulnerable code pattern:

$file = $_GET['file'];
include($file . '.php');

An attacker could send a request like:

http://target.com/wp-content/plugins/ajax-filter-posts/some-page.php?file=../../../../wp-config

This would include /var/www/html/wp-config.php (assuming the base path), exposing database credentials.

The vulnerability is classified as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') but in this case it is a Local File Inclusion (LFI) because the attacker is limited to files on the same server.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and what a secure version should look like.

Vulnerable Code (hypothetical):

<?php
$file = $_GET['file'];
include( plugin_dir_path( __FILE__ ) . 'views/' . $file . '.php' );
?>

Patched Code (recommended):

<?php
$allowed_files = array('list', 'grid', 'detail');
$file = $_GET['file'];
if ( in_array( $file, $allowed_files, true ) ) {
    include( plugin_dir_path( __FILE__ ) . 'views/' . $file . '.php' );
} else {
    // Handle error
}
?>

The patched version uses a whitelist of allowed filenames, preventing directory traversal and arbitrary file inclusion.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target WordPress site with Post Grid Master plugin <= 3.4.12
• Knowledge of the vulnerable parameter (likely file, template, or view)

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns include:
   • /wp-content/plugins/ajax-filter-posts/includes/class-ajax-filter-posts.php?file=...
   • /wp-content/plugins/ajax-filter-posts/public/partials/display.php?template=...
2. Use directory traversal to read sensitive files:

   GET /wp-content/plugins/ajax-filter-posts/some-page.php?file=../../../../wp-config HTTP/1.1
   Host: target.com
   

3. If the server returns the file content, you have successfully exploited the LFI.

Advanced Exploitation:

• Use PHP wrappers for code execution (if allow_url_include is enabled):

  ?file=php://input&cmd=system('id');
  

• Chain with file upload to include a malicious PHP file.

Blue Team

Detection:

• Monitor for directory traversal patterns in HTTP requests (e.g., ../, ..\\, %2e%2e%2f).
• Alert on requests to plugin files with suspicious parameters.
• Check for unexpected file inclusions in PHP error logs.

Hunting:

• Search for requests containing ajax-filter-posts and parameters like file, template, view.
• Look for outbound connections from the web server to unusual IPs (if RCE is achieved).

Lab Setup:

• Use a local WordPress installation with the vulnerable plugin.
• Set up a web server (Apache/Nginx) with PHP.
• Install the plugin from the WordPress repository (version 3.4.12 or earlier).
• Test the vulnerability by sending crafted requests.

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/plugins/ajax-filter-posts/
  • /wp-content/uploads/ (if attacker uploads malicious files)
• HTTP Request Patterns:
  • GET /wp-content/plugins/ajax-filter-posts/*.php?file=../../
  • GET /wp-content/plugins/ajax-filter-posts/*.php?template=php://input
• Log Entries:
  • PHP warnings about failed include() for paths containing ../
  • Access logs with %2e%2e%2f or ..%2f
• File System:
  • Unexpected files in /tmp/ or /var/www/html/wp-content/uploads/
  • Modified .htaccess files (if attacker gains code execution)

Detection Engineering

YARA Rule

rule CVE_2025_24733_LFI_Detection {
    meta:
        description = "Detects LFI attempts against Post Grid Master plugin"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-24733"
    strings:
        $traversal1 = "..\\"
        $traversal2 = "../"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e/"
        $plugin_path = "ajax-filter-posts"
    condition:
        any of ($traversal*) and $plugin_path
}

Sigma Rule

title: CVE-2025-24733 LFI Attempt Against Post Grid Master
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects directory traversal attempts targeting the Post Grid Master plugin
author: Valters IT
date: 2025/04/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-24733
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'ajax-filter-posts'
            - 'file=..'
            - 'template=..'
            - 'view=..'
    condition: selection
falsepositives:
    - Legitimate use of directory traversal in other contexts (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-24733 - Post Grid Master LFI Attempt";
    flow:to_server,established;
    content:"ajax-filter-posts"; http_uri;
    content:".."; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-24733;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. If disabling is not possible, implement a Web Application Firewall (WAF) rule to block directory traversal patterns.
3. Restrict file inclusion via PHP configuration:
   • Set allow_url_include = Off (default)
   • Set open_basedir to limit PHP file access.

Long-term Fix:

• The vendor must release a patched version that implements a whitelist of allowed files or uses realpath() to validate file paths.
• Users should update to the latest version once available.

Workaround:

• Add the following .htaccess rule to block suspicious requests:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (file|template|view)=.*\.\..* [NC]
  RewriteRule .* - [F,L]
  

Valters IT
Securing Digital Frontiers