CVE-2025-49282

Executive Summary

CVE-2025-49282 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Magze WordPress theme by Unfoldwp, affecting all versions up to and including 1.0.9. The vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading /etc/passwd, WordPress configuration files (wp-config.php), or other sensitive server files. The CVSS score of 8.1 (High) reflects the ease of exploitation and potential for significant data exposure. As a WordPress theme vulnerability, it is part of the broader WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability affects a WordPress theme distributed via the official WordPress theme repository and third-party marketplaces. Users who installed Magze from the WordPress dashboard or manually uploaded the theme are at risk. The lack of a known patch or official advisory from Unfoldwp increases the risk, as supply chain integrity is compromised. Organizations should immediately inventory any WordPress installations using the Magze theme and treat it as a high-priority security finding.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can expose sensitive data, including database credentials from wp-config.php.

Deep Dive & Mechanics

The Magze theme likely uses a PHP include statement that dynamically constructs a file path based on user-supplied input, such as a page or template parameter in the URL. For example, a vulnerable code snippet might look like:

include($_GET['template'] . '.php');

An attacker can manipulate the template parameter to include arbitrary files by using path traversal sequences (e.g., ../../../../etc/passwd%00). The null byte (%00) or other techniques may be used to truncate the .php extension, depending on PHP version and configuration. This allows reading any file on the server that the web server user has access to.

The vulnerability is classified as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), but in this case it is limited to local file inclusion (LFI) due to the theme's design.

Vulnerable vs. Patched Code

Vulnerable Code (Magze <= 1.0.9):

<?php
// Vulnerable include
$template = $_GET['template'];
include( get_template_directory() . '/templates/' . $template . '.php' );
?>

Patched Code (Hypothetical):

<?php
// Patched: Whitelist allowed templates
$allowed_templates = array('home', 'single', 'page', 'archive');
$template = $_GET['template'];
if ( in_array( $template, $allowed_templates ) ) {
    include( get_template_directory() . '/templates/' . $template . '.php' );
} else {
    // Default fallback
    include( get_template_directory() . '/templates/page.php' );
}
?>

The patched version uses a whitelist approach, ensuring only predefined template names are included. Alternatively, realpath() or basename() could be used to sanitize the input.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress with the Magze theme (version 1.0.9) on a local server (e.g., XAMPP, Docker).
2. Ensure the server is accessible via a web browser.

Exploitation Steps:

1. Identify the vulnerable parameter (likely template or page). Use a web proxy (Burp Suite) to intercept requests.
2. Craft a request to read /etc/passwd:

   GET /?template=../../../../etc/passwd%00 HTTP/1.1
   Host: target.com
   

3. If the null byte is filtered, try path traversal without extension:

   GET /?template=../../../../etc/passwd HTTP/1.1
   

4. For WordPress configuration:

   GET /?template=../../../../wp-config.php%00 HTTP/1.1
   

Note: The exact parameter name may vary. Use fuzzing tools like ffuf to discover it.

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for suspicious template or page parameters containing ../ or %00.
2. Deploy a WAF rule to block path traversal patterns in query strings.
3. Use file integrity monitoring (FIM) to detect unauthorized file access attempts.

Hunting Query (Splunk):

index=web sourcetype=access_combined uri_query=*template* | search uri_query=*../* OR uri_query=*%00*

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with template or page parameters containing ../ or %00.
  • Unusual file paths in URI, e.g., /etc/passwd, /wp-config.php.
• File System IOCs:
  • Unexpected access to /etc/passwd, /etc/shadow, or WordPress configuration files.
• Log IOCs:
  • Web server logs showing 200 responses to LFI attempts.
  • PHP error logs with "failed to open stream" messages for non-existent files.

Detection Engineering

YARA Rule

rule CVE_2025_49282_Magze_LFI {
    meta:
        description = "Detects LFI attempts targeting Magze theme CVE-2025-49282"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-49282"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\){2,}/
        $null_byte = /%00/
        $sensitive_file = /(etc\/passwd|wp-config\.php|\.env)/
    condition:
        any of ($path_traversal) and any of ($sensitive_file) or any of ($null_byte)
}

Sigma Rule

title: CVE-2025-49282 Magze Theme LFI Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects LFI attempts targeting the Magze WordPress theme
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - 'template='
            - 'page='
        c-uri|contains|all:
            - '../'
            - '%00'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other applications (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49282 Magze Theme LFI Attempt"; flow:to_server,established; content:"template="; http_uri; content:"../"; distance:0; within:100; content:"%00"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or remove the Magze theme from all WordPress installations until a patch is released.
2. Temporary Mitigation: Implement a Web Application Firewall (WAF) rule to block requests containing template= or page= with path traversal sequences.
3. Code Fix: If you have access to the theme source code, apply the whitelist-based patching approach described in the "Vulnerable vs. Patched Code" section.
4. Monitoring: Enable detailed logging for web servers and monitor for LFI attempts.
5. Update: Check the Unfoldwp website or WordPress theme repository for an official patched version. If none is available, consider switching to an alternative theme.

Valters IT
Securing Digital Frontiers