CVE-2025-26964

Executive Summary

CVE-2025-26964 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the WordPress plugin Eventin (formerly known as wp-event-solution) developed by Themewinter/Arraytics. The vulnerability resides in improper control of filenames used in PHP include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities.

The vulnerability affects all versions of Eventin from n/a through 4.0.20. As of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the technical severity remains high due to the potential impact.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to monitor the plugin's update channel and apply patches immediately when available. No known supply chain compromise has been reported.

CVSS Breakdown & Threat Level

CVSS Score: 7.5 (High) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The attacker does not need to trick a user.
• Scope (S): Unchanged – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High – Sensitive files (e.g., wp-config.php) can be read.
• Integrity (I): None – No file modification is possible via this vulnerability alone.
• Availability (A): None – No denial of service impact.

Threat Level: High. The ease of exploitation and potential for sensitive data exposure make this a priority for remediation.

Deep Dive & Mechanics

The vulnerability is a PHP Local File Inclusion (LFI) caused by insufficient sanitization of user-supplied input used in PHP's include() or require() functions. In the Eventin plugin, certain parameters (likely page, tab, or similar) are passed directly to a file inclusion construct without proper validation or path traversal checks.

Attack Flow:

1. An attacker sends a crafted HTTP request to a vulnerable endpoint of the Eventin plugin.
2. The request includes a parameter containing path traversal sequences (e.g., ../../../../etc/passwd).
3. The plugin's code uses this parameter in an include() statement without sanitization.
4. The server includes the specified local file, outputting its contents in the HTTP response.

Example vulnerable code pattern (conceptual):

$page = $_GET['page'];
include( $page . '.php' );

An attacker could exploit this by sending:

GET /wp-admin/admin.php?page=../../../../etc/passwd%00

The null byte (%00) may be used to terminate the string, bypassing the .php extension append.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common LFI fixes.

Vulnerable Code (Eventin <= 4.0.20):

// Vulnerable: Direct use of user input in include
$template = $_GET['template'];
include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );

Patched Code (Hypothetical):

// Patched: Whitelist allowed templates
$allowed_templates = array( 'event-list', 'event-detail', 'calendar' );
$template = $_GET['template'];
if ( in_array( $template, $allowed_templates ) ) {
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
} else {
    // Handle error
}

The patched version uses a whitelist approach, ensuring only predefined template names can be included. Additionally, realpath() or basename() functions could be used to strip path traversal sequences.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress installation with Eventin plugin version <= 4.0.20.
• Knowledge of a vulnerable endpoint (e.g., admin-ajax.php or a custom page).

Exploitation Steps:

1. Identify the vulnerable parameter. Common candidates: page, tab, template, view.
2. Craft a request to include a sensitive file:

   GET /wp-admin/admin.php?page=../../../../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. If the response contains the contents of /etc/passwd, the vulnerability is confirmed.
4. For WordPress-specific data, target wp-config.php:

   GET /wp-admin/admin.php?page=../../../../../../wp-config
   

   (Note: The .php extension may be appended automatically; use null byte or path encoding to bypass.)

Lab Setup:

• Use Docker to spin up a vulnerable WordPress environment:

  docker run -d --name wp-vuln -p 8080:80 wordpress:latest
  # Then manually install Eventin 4.0.20 from a local zip
  

• Alternatively, use a tool like wpscan to enumerate the plugin version.

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious path traversal patterns in request URIs.
• Look for requests containing ../, %2e%2e%2f, or null bytes (%00).
• Alert on attempts to access files outside the web root (e.g., /etc/passwd, /windows/win.ini).

Mitigation:

• Immediately disable or remove the Eventin plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block path traversal attempts.
• Use virtual patching via mod_security or equivalent.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing ../ or %2e%2e%2f in parameters.
• Requests to wp-admin/admin.php or wp-admin/admin-ajax.php with suspicious page or template parameters.
• Outbound connections from the web server to unknown IPs (if RCE is achieved).

File System IOCs:

• Unexpected inclusion of files like /etc/passwd, /proc/self/environ, or wp-config.php in web responses.
• Presence of webshells in the WordPress uploads directory (if combined with file upload).

Log IOCs:

• Apache/Nginx access logs showing 404 or 200 responses for non-existent paths like ../../etc/passwd.
• PHP error logs indicating failed include() attempts.

Detection Engineering

YARA Rule

rule CVE_2025_26964_Eventin_LFI {
    meta:
        description = "Detects attempts to exploit CVE-2025-26964 in Eventin plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-26964"
    strings:
        $path_traversal1 = "../"
        $path_traversal2 = "..\\"
        $path_traversal3 = "%2e%2e%2f"
        $path_traversal4 = "%2e%2e%5c"
        $sensitive_file1 = "/etc/passwd"
        $sensitive_file2 = "wp-config.php"
        $sensitive_file3 = "/proc/self/environ"
    condition:
        any of ($path_traversal*) and any of ($sensitive_file*)
}

Sigma Rule

title: CVE-2025-26964 Eventin LFI Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit PHP Local File Inclusion in Eventin plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
            - '/etc/passwd'
            - 'wp-config.php'
            - '/proc/self/environ'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other applications (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26964 Eventin LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"../"; http_uri; nocase; content:"/etc/passwd"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Deactivate and remove Eventin from all WordPress installations until a patch is released.
2. Apply virtual patching – Use a WAF to block requests containing path traversal sequences.
3. Monitor logs – Review web server and application logs for signs of exploitation.

Long-term Fixes:

• The vendor (Themewinter/Arraytics) must release a patched version that implements input validation and whitelisting for file inclusion parameters.
• Users should update to the latest version once available.
• Implement file inclusion best practices: use realpath() to resolve paths, restrict to a whitelist, and avoid user input in include()/require().

Workaround:

• If the plugin is critical, consider replacing it with an alternative event management plugin that is actively maintained.

Valters IT
Securing Digital Frontiers