CVE-2025-26979

Executive Summary

CVE-2025-26979 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Funnel Builder by FunnelKit WordPress plugin, affecting versions up to and including 3.9.0. The vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The vulnerability has a CVSS score of 7.5 (High) and is currently unpatched, with no public exploit code available. As a WordPress plugin vulnerability, it specifically impacts the WordPress ecosystem and does not involve Apache or Nginx server misconfigurations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and commercial marketplaces. Organizations using Funnel Builder by FunnelKit should immediately assess their exposure, as no patch is currently available. The lack of a patch increases supply chain risk, as attackers may target unpatched installations. Administrators should consider disabling the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full file read access.
• Integrity Impact: None (I:N) – No file modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and can expose sensitive server files.

Deep Dive & Mechanics

The vulnerability exists in the Funnel Builder by FunnelKit plugin, which provides a drag-and-drop funnel builder for WordPress. The plugin uses PHP include() or require() statements to load template files or other resources. The filename passed to these functions is not properly sanitized or validated, allowing an attacker to manipulate it using path traversal sequences (e.g., ../../).

Root Cause: The plugin likely constructs a file path by concatenating a user-supplied parameter (e.g., $_GET['template'] or $_POST['file']) with a base directory. Without proper filtering, an attacker can inject ../ sequences to escape the intended directory and include arbitrary files from the server.

Example vulnerable code pattern:

$template = $_GET['template'];
include(plugin_dir_path(__FILE__) . 'templates/' . $template . '.php');

An attacker could supply ../../../../etc/passwd%00 to attempt null byte injection (though modern PHP versions mitigate this) or simply ../../../../wp-config to read the WordPress configuration file.

Impact: Successful exploitation allows reading any file readable by the web server user, including:

• wp-config.php (database credentials, salts)
• /etc/passwd (user enumeration)
• Log files (potential session hijacking)
• Source code of other plugins/themes

Vulnerable vs. Patched Code

Since no patch is available, the following shows a hypothetical vulnerable code snippet and a secure version.

Vulnerable Code (funnel-builder/includes/class-funnel-builder.php):

public function load_template($template_name) {
    $path = plugin_dir_path(__FILE__) . 'templates/' . $template_name . '.php';
    if (file_exists($path)) {
        include($path);
    }
}

The $template_name is taken directly from user input without sanitization.

Patched Code (Hypothetical):

public function load_template($template_name) {
    // Whitelist allowed templates
    $allowed_templates = array('checkout', 'landing', 'thankyou');
    if (!in_array($template_name, $allowed_templates)) {
        wp_die('Invalid template.');
    }
    $path = plugin_dir_path(__FILE__) . 'templates/' . $template_name . '.php';
    if (file_exists($path)) {
        include($path);
    }
}

The patched version uses a whitelist to restrict which templates can be included, preventing path traversal.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Funnel Builder by FunnelKit <= 3.9.0 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable parameter. Common parameters include template, file, page, or view in the plugin's AJAX endpoints or shortcodes.
2. Craft a payload to traverse directories and read sensitive files.
3. Send the request.

Example Request (using curl):

curl -v "http://target.com/wp-admin/admin-ajax.php?action=funnel_load_template&template=../../../../wp-config"

Or via a direct URL:

curl -v "http://target.com/?funnel_template=../../../../etc/passwd"

Expected Output: The contents of the requested file will be displayed in the response body (if PHP errors are displayed) or included in the page output.

Note: No public exploit code is available, so this is a conceptual demonstration.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web server logs for path traversal patterns in request parameters (e.g., ../, %2e%2e%2f).
2. Look for requests to plugin-specific endpoints with suspicious parameters.
3. Check for unexpected file inclusions in PHP error logs.

Response:

1. Immediately disable the Funnel Builder plugin if no patch is available.
2. Review server logs for signs of exploitation (e.g., reading wp-config.php).
3. Rotate all database credentials and salts if compromise is suspected.
4. Implement a Web Application Firewall (WAF) rule to block path traversal attempts.

Indicators of Compromise (IOCs)

• File Paths Accessed:

  • /etc/passwd
  • /etc/shadow
  • /wp-config.php
  • /var/log/apache2/access.log
  • /var/log/nginx/access.log

• URL Patterns:

  • ?funnel_template=../../../
  • ?action=funnel_load_template&template=../../../
  • ?page=funnel-builder&view=../../../

• Log Entries:

  • GET /?funnel_template=../../../../etc/passwd HTTP/1.1
  • POST /wp-admin/admin-ajax.php with action=funnel_load_template and template=../../../

• Network Indicators:

  • Outbound connections from the web server to unknown IPs (if RCE is achieved).

Detection Engineering

YARA Rule

rule CVE_2025_26979_LFI_Detection {
    meta:
        description = "Detects path traversal attempts targeting Funnel Builder by FunnelKit"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26979"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\){2,}/
        $plugin_param = /(funnel_template|funnel_load_template|template|view)/
        $sensitive_file = /(wp-config|passwd|shadow|\.env|config\.php)/
    condition:
        any of ($plugin_param) and any of ($path_traversal) and any of ($sensitive_file)
}

Sigma Rule

title: CVE-2025-26979 - Funnel Builder LFI Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in Funnel Builder by FunnelKit plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'funnel_template='
            - 'funnel_load_template='
            - 'template='
            - 'view='
        cs-uri-query|re: '(\.\.\/|\.\.\\){2,}'
    condition: selection
falsepositives:
    - Legitimate use of nested directories (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-26979 - Funnel Builder LFI Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"funnel_template"; http_uri;
    content:"../"; distance:0; within:100;
    pcre:"/(\.\.\/){2,}/U";
    reference:cve,2025-26979;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by the vendor.
2. Implement a WAF rule to block path traversal patterns (e.g., ../, %2e%2e%2f).
3. Monitor logs for exploitation attempts.

Long-term Fixes:

• Apply the vendor patch when available.
• Replace the plugin with an alternative if no patch is forthcoming.
• Conduct a security audit of all WordPress plugins.

Workaround (if plugin must remain active):

• Add the following to .htaccess to block suspicious parameters:

RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\.\/|\.\.\\) [NC]
RewriteRule ^ - [F,L]

Valters IT Signature This report was generated by Valters IT Cyber Threat Intelligence Division. For questions, contact threatintel@valtersit.com.