CVE-2025-46230

Executive Summary

CVE-2025-46230 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the GhozyLab Popup Builder plugin for WordPress, specifically in the easy-notify-lite component. The vulnerability stems from improper control of a filename used in an include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading configuration files (e.g., wp-config.php), source code, or other system files. The CVSS score of 7.5 (High) reflects the ease of exploitation and potential for significant data exposure. As a WordPress plugin vulnerability, it affects sites running version 1.1.35 or earlier. No patch is currently available, making this a zero-day threat for unpatched installations.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The affected component, easy-notify-lite, is distributed via the WordPress plugin repository. Users should verify their plugin version and monitor for updates from the vendor. Since no patch exists, immediate mitigation through web application firewall (WAF) rules or disabling the plugin is recommended.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability affects only the vulnerable component.
• Confidentiality Impact: High (C:H) – Full file read capability.
• Integrity Impact: None (I:N) – No file modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can expose sensitive data like database credentials, API keys, and source code.

Deep Dive & Mechanics

The vulnerability exists in the easy-notify-lite plugin's PHP code, where a user-supplied parameter is used directly in a PHP include() or require() statement without proper sanitization or validation. This allows an attacker to manipulate the filename to traverse directories and include arbitrary files from the server.

Root Cause: The plugin likely uses a parameter like file, page, or template to dynamically include PHP files. The code does not check for path traversal sequences (e.g., ../) or restrict the include path to a specific directory.

Example vulnerable code pattern:

$file = $_GET['file'];
include($file . '.php');

An attacker can supply ../../../wp-config to read the WordPress configuration file.

WordPress Context: Since this is a WordPress plugin, the vulnerability is triggered via HTTP requests to the WordPress installation. The plugin's functionality is exposed through WordPress hooks, making it accessible to unauthenticated users if the plugin registers shortcodes or AJAX actions without proper capability checks.

Vulnerable vs. Patched Code

Vulnerable Code (<= 1.1.35):

// In some plugin file
$template = $_REQUEST['template'];
include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );

This code directly uses user input in the include path without sanitization.

Patched Code (Hypothetical):

// Patched version
$allowed_templates = array('default', 'popup', 'slidein');
$template = sanitize_file_name( $_REQUEST['template'] );
if ( in_array( $template, $allowed_templates ) ) {
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
} else {
    // Handle error
}

The patched version validates the input against a whitelist and sanitizes the filename.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Popup Builder plugin <= 1.1.35 installed and active.
• Network access to the target.

Exploitation Steps:

1. Identify the vulnerable parameter. Common parameters include file, template, page, or include.
2. Craft a request to include a sensitive file, e.g., wp-config.php.
3. Use path traversal to navigate to the file.

Example Request:

GET /wp-content/plugins/easy-notify-lite/vulnerable-file.php?file=../../../wp-config HTTP/1.1
Host: target.com

If the plugin appends .php, the request would be:

GET /wp-content/plugins/easy-notify-lite/vulnerable-file.php?file=../../../wp-config&ext=.php HTTP/1.1
Host: target.com

Automated Exploitation (cURL):

curl -v "http://target.com/wp-content/plugins/easy-notify-lite/vulnerable-file.php?file=../../../wp-config"

Expected Output: The contents of wp-config.php (database credentials, salts, etc.) will be displayed in the response.

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for requests containing ../ or ..%2f in parameters.
• Look for requests to plugin files with suspicious parameters like file=, template=, or include=.
• Alert on requests that attempt to read wp-config.php, .env, or other sensitive files.

Response:

1. Immediately block the attacking IP address.
2. Disable the easy-notify-lite plugin until a patch is applied.
3. Review server logs for any successful exploitation (e.g., 200 responses to LFI attempts).
4. Rotate any credentials exposed (database passwords, API keys, etc.).
5. Implement a WAF rule to block path traversal patterns.

Indicators of Compromise (IOCs)

File-Based IOCs:

• Suspicious log entries with path traversal sequences in GET/POST parameters.
• Unexpected access to wp-config.php, /etc/passwd, or other system files via the web server.

Network IOCs:

• HTTP requests containing ../ or ..%2f in the query string.
• Requests to plugin files like easy-notify-lite with parameters like file=, template=, or include=.

Example Log Entry:

192.168.1.100 - - [10/May/2025:12:34:56 +0000] "GET /wp-content/plugins/easy-notify-lite/vulnerable-file.php?file=../../../wp-config HTTP/1.1" 200 5432 "-" "Mozilla/5.0"

Detection Engineering

YARA Rule

rule CVE_2025_46230_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting CVE-2025-46230 in Popup Builder plugin"
        author = "Valters IT"
        date = "2025-05-10"
        reference = "CVE-2025-46230"
    strings:
        $path_traversal = /\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c/
        $sensitive_file = /wp-config\.php|\.env|\.htaccess|passwd|shadow/
        $plugin_param = /file=|template=|include=|page=/
    condition:
        $path_traversal and $sensitive_file and $plugin_param
}

Sigma Rule

title: CVE-2025-46230 LFI Attempt Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit LFI in Popup Builder plugin
author: Valters IT
date: 2025-05-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'file='
            - 'template='
            - 'include='
            - 'page='
        cs-uri-query|contains:
            - '../'
            - '..%2f'
            - '%2e%2e%2f'
            - '..\\'
        cs-uri-query|contains:
            - 'wp-config.php'
            - '.env'
            - '/etc/passwd'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (rare)
level: high
tags:
    - attack.t1190
    - cve.2025.46230

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-46230 LFI Attempt - Popup Builder Plugin"; flow:to_server,established; content:"GET"; http_method; content:"easy-notify-lite"; http_uri; content:"file="; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Plugin: Deactivate and delete the easy-notify-lite plugin until a patch is released.
2. Web Application Firewall (WAF): Deploy WAF rules to block path traversal patterns (e.g., ../, ..%2f) in request parameters.
3. Input Validation: If you must keep the plugin, implement a reverse proxy that validates and sanitizes all input parameters.

Long-Term Fix:

• Monitor the GhozyLab plugin repository for an update. Apply the patch as soon as it becomes available.
• Consider replacing the plugin with an alternative that is actively maintained and secure.

Configuration Hardening:

• Ensure WordPress and all plugins are updated to the latest versions.
• Restrict file permissions on sensitive files (e.g., wp-config.php should be readable only by the web server user).
• Use a security plugin (e.g., Wordfence) to detect and block LFI attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert