CVE-2025-49280

Executive Summary

CVE-2025-49280 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Magty WordPress theme developed by Unfoldwp. The vulnerability stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, including configuration files, database credentials, and potentially source code. The vulnerability affects all versions of Magty up to and including 1.0.6. As of this report, no official patch has been released, and no public proof-of-concept (PoC) code is available.

Supply Chain & Package Security

This vulnerability resides in a WordPress theme, which is distributed through the official WordPress theme repository and potentially third-party marketplaces. The supply chain risk is significant because:

• Widespread Distribution: The theme may be installed on thousands of sites, making it a high-value target for automated scanning and exploitation.
• Delayed Patching: As a theme, updates are controlled by the vendor (Unfoldwp). Without a patch, site administrators must manually mitigate the risk.
• Dependency Chain: The theme may rely on other plugins or libraries, which could also be vulnerable. However, this specific issue is isolated to the theme's own code.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Sensitive files can be read.
• Integrity Impact: None (I:N) – No file modification is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The low attack complexity and lack of authentication make this a prime target for automated exploitation, especially given the widespread use of WordPress.

Deep Dive & Mechanics

The vulnerability is a classic PHP Local File Inclusion (LFI) issue, categorized under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program. In the Magty theme, a PHP function (likely within a custom shortcode, widget, or template tag) accepts a user-supplied parameter that is used directly in a include() or require() statement without proper sanitization or validation.

How it works:

1. An attacker identifies a parameter (e.g., ?file=, ?template=, or a POST parameter) that the theme uses to load a file.
2. The attacker supplies a path traversal sequence (e.g., ../../../../etc/passwd) to escape the intended directory.
3. The PHP include() function then loads the attacker-specified file, outputting its contents (if it's a text file) or executing it (if it's a PHP file).

Example vulnerable code pattern:

$file = $_GET['file'];
include( get_template_directory() . '/includes/' . $file . '.php' );

An attacker could request ?file=../../../../etc/passwd to read the system's password file.

Why it's dangerous:

• Information Disclosure: Attackers can read wp-config.php to obtain database credentials, salts, and keys.
• Code Execution: If the attacker can upload a file (e.g., via another vulnerability or a misconfigured upload feature), they can include it and execute arbitrary PHP code.
• Privilege Escalation: Exposed credentials can lead to full site compromise.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code and the required fix.

Vulnerable Code (Hypothetical):

// In a theme function, e.g., magty_load_template()
function magty_load_template() {
    $template = $_GET['template'];
    include( get_template_directory() . '/templates/' . $template . '.php' );
}

Patched Code (Recommended):

function magty_load_template() {
    $template = sanitize_file_name( $_GET['template'] );
    $allowed_templates = array( 'default', 'full-width', 'sidebar-left' );
    if ( in_array( $template, $allowed_templates, true ) ) {
        include( get_template_directory() . '/templates/' . $template . '.php' );
    } else {
        // Fallback to default template
        include( get_template_directory() . '/templates/default.php' );
    }
}

Key differences:

• Input Validation: The patched version uses sanitize_file_name() to remove path traversal characters and validates the input against a whitelist of allowed templates.
• Whitelist Approach: Instead of blacklisting dangerous characters, the patched code only allows specific, predefined values.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site running Magty theme version <= 1.0.6.
• Knowledge of the vulnerable parameter (e.g., ?template=, ?file=, or a POST parameter). This requires reconnaissance or source code review.

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a tool like Burp Suite or curl to fuzz for parameters. Common patterns include ?file=, ?include=, ?template=, or ?load=.
2. Test for LFI: Send a request with a path traversal payload:

   curl "http://target.com/?template=../../../../etc/passwd"
   

3. Read sensitive files: If successful, the contents of /etc/passwd will be displayed. For WordPress, target wp-config.php:

   curl "http://target.com/?template=../../../../wp-config"
   

   Note: The .php extension is appended automatically, so you may need to use a null byte or other technique to bypass this. In PHP < 5.3.4, a null byte (%00) can truncate the string. For modern PHP, try using a wrapper like php://filter:

   curl "http://target.com/?template=php://filter/convert.base64-encode/resource=../../../../wp-config"
   

4. Achieve RCE (if possible): If you can upload a file (e.g., via a media upload vulnerability or a misconfigured plugin), include it:

   curl "http://target.com/?template=../../../../wp-content/uploads/evil"
   

Lab Setup:

• Use a local WordPress installation with the Magty theme.
• Install a vulnerable version (1.0.6 or earlier) from the WordPress theme repository or a mirror.
• Set up a web server (Apache/Nginx) with PHP.
• Use a tool like docker for quick deployment:

  docker run --name wp-magty -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=wordpress -e WORDPRESS_DB_PASSWORD=wordpress -e WORDPRESS_DB_NAME=wordpress -p 8080:80 -d wordpress
  

  Then manually install the Magty theme.

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious parameters containing ../, %00, or php://.
• Look for requests to theme files with unexpected parameters.
• Use a Web Application Firewall (WAF) to block path traversal patterns.

Mitigation:

• Immediate: Disable the vulnerable theme and switch to a different theme.
• Code Fix: Apply the whitelist-based input validation as shown in the patched code section.
• Server Hardening: Disable allow_url_include in php.ini to prevent remote file inclusion.
• File Permissions: Ensure wp-config.php is not readable by the web server user (e.g., chmod 600).

Indicators of Compromise (IOCs)

• File Paths: Requests containing ../, ..\\, or %2e%2e%2f in parameters.
• URL Patterns: ?template=, ?file=, ?include=, ?load= followed by path traversal sequences.
• Log Entries: Web server logs showing attempts to read /etc/passwd, wp-config.php, or other sensitive files.
• Error Messages: PHP warnings like Warning: include(../../../../etc/passwd.php): failed to open stream in error logs.
• Network Traffic: Outbound connections from the server to external IPs (if RCE is achieved).

Detection Engineering

YARA Rule

rule CVE_2025_49280_Magty_LFI {
    meta:
        description = "Detects attempts to exploit CVE-2025-49280 in Magty WordPress theme"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49280"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\|%2e%2e%2f|%252e%252e%252f)/
        $sensitive_file = /(etc\/passwd|wp-config\.php|\.env|config\.php)/
        $vuln_param = /(\?template=|\?file=|\?include=|\?load=)/
    condition:
        any of ($path_traversal) and any of ($sensitive_file) and any of ($vuln_param)
}

Sigma Rule

title: CVE-2025-49280 Magty LFI Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit LFI in Magty theme
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - '..'
            - '%2e%2e'
            - 'php://'
            - 'wp-config.php'
            - '/etc/passwd'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other applications (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49280 Magty LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:".."; http_uri; content:"wp-config.php"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Magty theme and switch to a different, actively maintained theme.
2. Apply a virtual patch using a WAF (e.g., ModSecurity) to block path traversal patterns:

   SecRule ARGS "@contains ../" "id:1000002,phase:2,deny,status:403,msg:'LFI Attempt'"
   

3. Review server logs for any signs of exploitation.

Long-term Fix:

• Vendor Patch: Await an official update from Unfoldwp. Monitor their website or the WordPress theme repository for a patched version.
• Code Audit: If you have access to the theme source code, apply the whitelist-based input validation as described in the "Vulnerable vs. Patched Code" section.
• Security Hardening: Implement the following in wp-config.php:

  define('DISALLOW_FILE_EDIT', true);
  define('FORCE_SSL_ADMIN', true);
  

Preventive Measures:

• Regularly update all WordPress themes and plugins.
• Use a security plugin (e.g., Wordfence, Sucuri) to monitor for file inclusion attempts.
• Implement a Content Security Policy (CSP) to mitigate the impact of code execution.

This report was generated by Valters IT DevSecOps & CTI Division. For questions, contact cti@valters.it.