CVE-2025-30895

Executive Summary

CVE-2025-30895 is a critical Path Traversal vulnerability (CWE-98) affecting the WpEvently WordPress plugin (slug: mage-eventpress) by Magepeopleteam, up to version 4.2.9. This flaw allows an unauthenticated attacker to perform PHP Local File Inclusion (LFI), enabling the reading of arbitrary files on the server, including sensitive configuration files like wp-config.php. The vulnerability stems from improper sanitization of user-supplied pathnames, allowing traversal outside the intended directory. As a WordPress plugin vulnerability, it directly impacts the WordPress ecosystem and does not involve Apache or Nginx core issues.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and through the vendor's own channels. Users are advised to verify the integrity of their plugin files and ensure they are sourced from trusted repositories. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors embedding backdoors in unpatched installations.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The high confidentiality impact reflects the ability to read sensitive files, including database credentials, API keys, and source code. The low attack complexity and lack of authentication make this a high-priority threat for all WordPress sites using the vulnerable plugin.

Deep Dive & Mechanics

The vulnerability resides in the file inclusion mechanism of the WpEvently plugin. The plugin likely uses a parameter (e.g., page, file, or template) to dynamically include PHP files. Due to insufficient input validation, an attacker can inject path traversal sequences (e.g., ../../../) to escape the intended directory and include arbitrary files from the server.

Example vulnerable code pattern:

$file = $_GET['file'];
include($file . '.php');

An attacker can exploit this by sending a request like:

GET /wp-content/plugins/mage-eventpress/some-page.php?file=../../../../wp-config

This would include /var/www/html/wp-config.php (assuming the WordPress root is at /var/www/html), exposing database credentials and other secrets.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be present in all versions up to 4.2.9. A hypothetical patched version would implement strict path validation, such as:

Vulnerable (<=4.2.9):

$file = $_GET['file'];
include(plugin_dir_path(__FILE__) . $file . '.php');

Patched (hypothetical):

$allowed_files = ['dashboard', 'events', 'settings'];
$file = basename($_GET['file']);
if (in_array($file, $allowed_files)) {
    include(plugin_dir_path(__FILE__) . $file . '.php');
} else {
    wp_die('Invalid file.');
}

The patched version uses basename() to strip directory traversal and whitelists allowed files.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress installation with WpEvently plugin version <= 4.2.9.
• Knowledge of the server's file system structure (e.g., WordPress root path).

Exploitation Steps:

1. Identify the vulnerable endpoint (e.g., /wp-content/plugins/mage-eventpress/includes/load.php?file=).
2. Craft a payload to traverse to the WordPress configuration file:

   GET /wp-content/plugins/mage-eventpress/includes/load.php?file=../../../../wp-config
   

3. The server will include wp-config.php, revealing database credentials.
4. Use the credentials to access the database and extract user data or escalate privileges.

Example cURL command:

curl -v "http://target.com/wp-content/plugins/mage-eventpress/includes/load.php?file=../../../../wp-config"

Blue Team (Detection & Mitigation)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../ sequences in GET parameters).
• Use WAF rules to block requests containing ../ in parameters associated with the plugin.
• Implement file integrity monitoring for critical WordPress files.

Mitigation:

• Immediately disable or remove the WpEvently plugin until a patch is released.
• Apply a virtual patch via WAF to block path traversal attempts.
• Restrict file permissions on wp-config.php to prevent reading by the web server user.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing ../ sequences in parameters like file, page, or template targeting /wp-content/plugins/mage-eventpress/.
  • Unusual outbound connections from the web server to external IPs (if the attacker exfiltrates data).

• File System IOCs:

  • Unexpected modifications to wp-config.php or other sensitive files.
  • Presence of new PHP files in the plugin directory (backdoors).

• Log IOCs:

  • Web server logs showing 200 responses to requests with path traversal patterns.
  • PHP error logs indicating failed includes or file not found errors.

Detection Engineering

YARA Rule

rule CVE_2025_30895_WpEvently_LFI {
    meta:
        description = "Detects path traversal attempts against WpEvently plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-30895"
    strings:
        $traversal = /\.\.\/\.\.\/\.\.\//
        $plugin_path = /mage-eventpress/
    condition:
        $traversal and $plugin_path
}

Sigma Rule

title: CVE-2025-30895 WpEvently Path Traversal Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests with path traversal patterns targeting WpEvently plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - 'mage-eventpress'
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other contexts
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-30895 WpEvently Path Traversal Attempt"; flow:to_server; content:"mage-eventpress"; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the WpEvently plugin until a patched version is released.
2. Virtual Patching: Deploy a WAF rule to block requests containing ../ in parameters associated with the plugin.
3. File Permissions: Ensure wp-config.php is not readable by the web server user (e.g., chmod 600).
4. Monitoring: Enable detailed logging for the plugin's endpoints and review logs for suspicious activity.
5. Update: Monitor the vendor's website for a patched version and apply it as soon as available.

Valters IT
Securing Digital Frontiers