CVE-2025-52715

Executive Summary

CVE-2025-52715 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the RadiusTheme Classified Listing plugin for WordPress, affecting versions up to and including 4.2.0. The vulnerability stems from improper control of filenames used in include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading configuration files containing database credentials, source code, or other critical data. The CVSS score of 7.5 (High) reflects the ease of exploitation (network-based, low complexity, no privileges required) and the high impact on confidentiality. No public proof-of-concept (PoC) or patch details are currently available, making this a zero-day threat for unpatched installations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who installed the plugin via the WordPress dashboard or directly from the repository are at risk. The plugin is not available on NPM, PyPI, Go, or Ruby ecosystems.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No impact on availability.

Threat Level: High. The combination of remote, unauthenticated access with low complexity makes this a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability exists in the PHP include/require statement handling within the Classified Listing plugin. The plugin likely uses a dynamic file inclusion mechanism where a user-supplied parameter (e.g., page, template, or view) is used to construct a file path without proper sanitization. An attacker can manipulate this parameter to include arbitrary files from the server, such as /etc/passwd, /wp-config.php, or other sensitive files.

The core issue is the lack of input validation and path traversal prevention. The plugin may use functions like include() or require() with a concatenated string that includes user input, allowing directory traversal sequences like ../ to escape the intended directory.

Example vulnerable code pattern:

$page = $_GET['page'];
include(plugin_dir_path(__FILE__) . 'templates/' . $page . '.php');

An attacker could supply ../../../../etc/passwd%00 to null-terminate the string and include /etc/passwd.

Vulnerable vs. Patched Code

Vulnerable Code (<= 4.2.0):

// Vulnerable: Direct user input used in include
$template = $_GET['template'];
include(plugin_dir_path(__FILE__) . 'views/' . $template . '.php');

Patched Code (Hypothetical):

// Patched: Whitelist allowed templates
$allowed_templates = ['list', 'detail', 'search'];
$template = $_GET['template'];
if (in_array($template, $allowed_templates)) {
    include(plugin_dir_path(__FILE__) . 'views/' . $template . '.php');
} else {
    // Default or error handling
    include(plugin_dir_path(__FILE__) . 'views/list.php');
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with Classified Listing plugin <= 4.2.0 installed and activated.
• Knowledge of the vulnerable parameter (e.g., template, page, view).

Exploitation Steps:

1. Identify the vulnerable endpoint. Common patterns include:
   • http://target/wp-content/plugins/classified-listing/
   • http://target/?page=classified-listing&template=...
2. Attempt path traversal to read sensitive files:

   http://target/?page=classified-listing&template=../../../../etc/passwd
   

3. If null byte injection works (PHP < 5.3.4), use:

   http://target/?page=classified-listing&template=../../../../etc/passwd%00
   

4. Read WordPress configuration:

   http://target/?page=classified-listing&template=../../../../wp-config
   

Lab Setup:

• Use Docker to spin up a vulnerable WordPress environment:

  docker run -d --name wp-vuln -p 8080:80 wordpress:latest
  

• Install the vulnerable plugin manually by downloading version 4.2.0 from the WordPress plugin repository and placing it in /var/www/html/wp-content/plugins/classified-listing/.

Blue Team

Detection:

• Monitor web server logs for suspicious ../ patterns in GET parameters.
• Look for requests to classified-listing with unusual template or page values.
• Alert on attempts to read /etc/passwd, /wp-config.php, or other sensitive files.

Hunting:

• Search for HTTP requests containing classified-listing and path traversal sequences.
• Correlate with file access logs to identify successful LFI attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP GET requests with template=../../../../etc/passwd or similar patterns.
  • Requests to /wp-content/plugins/classified-listing/ with suspicious parameters.
• File System IOCs:
  • Unexpected access to /etc/passwd, /etc/shadow, /wp-config.php.
  • Plugin directory containing files with unusual names or permissions.
• Log IOCs:
  • Web server logs showing 404 or 200 responses for path traversal attempts.
  • PHP error logs indicating failed include attempts.

Detection Engineering

YARA Rule

rule CVE_2025_52715_LFI_Classified_Listing {
    meta:
        description = "Detects LFI attempts targeting CVE-2025-52715 in Classified Listing plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-52715"
    strings:
        $s1 = "classified-listing" nocase
        $s2 = "template=" nocase
        $s3 = "../" nocase
        $s4 = "/etc/passwd" nocase
        $s5 = "/wp-config" nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-52715 LFI Attempt on Classified Listing Plugin
id: 8a3f7c2e-1b5d-4a9f-8c6e-3d2f1a0b9c8e
status: experimental
description: Detects path traversal attempts targeting the Classified Listing plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'classified-listing'
            - 'template='
            - '../'
            - '/etc/passwd'
            - '/wp-config'
    condition: selection
falsepositives:
    - Legitimate use of similar patterns (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-52715 LFI Attempt on Classified Listing Plugin"; flow:to_server,established; content:"GET"; http_method; content:"classified-listing"; http_uri; content:"template="; http_uri; content:"../"; distance:0; within:10; http_uri; content:"/etc/passwd"; distance:0; within:20; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Classified Listing plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
3. Restrict file inclusion to a whitelist of allowed templates.

Long-term Fix:

• Apply the official patch from RadiusTheme when released.
• Upgrade to a patched version (currently unknown).
• Conduct a security audit of the plugin's codebase.

Workarounds:

• Use a reverse proxy to filter malicious requests.
• Set allow_url_include = Off in php.ini (though this is for RFI, not LFI).
• Monitor logs for exploitation attempts.

Valters IT
Securing Digital Frontiers