CVE-2025-53567

Executive Summary

CVE-2025-53567 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Ghost Kit WordPress plugin (versions <= 3.4.1). The vulnerability stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The CVSS score of 8.1 (High) reflects the low attack complexity and network-based attack vector. No public proof-of-concept or patch is currently available, making this a high-priority zero-day for WordPress administrators.

Supply Chain & Package Security

This vulnerability affects the Ghost Kit WordPress plugin, which is distributed through the official WordPress plugin repository. As a supply chain risk, any site using this plugin is vulnerable. Administrators should immediately check their plugin version and disable the plugin until a patch is released. The lack of a patch from the vendor (nK) increases the risk of exploitation in the wild.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The combination of network exploitability, no authentication, and high confidentiality impact makes this a serious threat. The EPSS score of 0.0% suggests low exploitation likelihood currently, but this may change as details become public.

Deep Dive & Mechanics

The vulnerability is a PHP Local File Inclusion (LFI) in the Ghost Kit plugin. The plugin likely uses a user-supplied parameter (e.g., include, file, template) in a PHP include() or require() function without proper sanitization or validation. An attacker can manipulate this parameter to include arbitrary files from the server's filesystem.

Example vulnerable code pattern:

$file = $_GET['file'];
include($file . '.php');

An attacker could request:

http://target.com/wp-content/plugins/ghostkit/vulnerable.php?file=../../../../etc/passwd

This would include /etc/passwd (if the .php extension is appended, path traversal can bypass it using null bytes or other techniques).

WordPress-specific context: The plugin is a WordPress component, so the attack targets the WordPress installation. The attacker can read wp-config.php to obtain database credentials, salts, and other sensitive data.

Vulnerable vs. Patched Code

Vulnerable Code (Ghost Kit <= 3.4.1):

// Hypothetical vulnerable function
function ghostkit_include_template() {
    $template = $_GET['template'];
    include(plugin_dir_path(__FILE__) . 'templates/' . $template . '.php');
}

Patched Code (Hypothetical):

function ghostkit_include_template() {
    $allowed_templates = array('default', 'custom', 'full-width');
    $template = $_GET['template'];
    if (in_array($template, $allowed_templates)) {
        include(plugin_dir_path(__FILE__) . 'templates/' . $template . '.php');
    } else {
        // Error handling
    }
}

The patch would implement a whitelist of allowed filenames, preventing arbitrary file inclusion.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Lab Setup:

1. Install WordPress with Ghost Kit plugin version 3.4.1.
2. Identify the vulnerable parameter (e.g., file, include, template).
3. Use a tool like Burp Suite or curl.

Exploitation Steps:

1. Basic LFI to read /etc/passwd:

   curl "http://target.com/wp-content/plugins/ghostkit/vulnerable.php?file=../../../../etc/passwd"
   

2. Read wp-config.php:

   curl "http://target.com/wp-content/plugins/ghostkit/vulnerable.php?file=../../../../wp-config"
   

   (Note: The .php extension may be appended; use null byte %00 or path truncation if needed.)
3. Attempt RCE via log poisoning: If the server logs user input (e.g., User-Agent), include the log file and execute PHP code.

Blue Team (Defense & Detection)

Detection:

• Monitor web server logs for suspicious file or include parameters containing ../ or /etc/.
• Use WAF rules to block path traversal patterns.
• Deploy the detection rules below.

Mitigation:

• Disable the Ghost Kit plugin immediately.
• Apply virtual patching via WAF.
• Monitor for unauthorized file access attempts.

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /etc/shadow, /wp-config.php, /proc/self/environ
• URL Patterns: ?file=, ?include=, ?template= followed by ../ or absolute paths.
• Log Entries: HTTP requests with %2e%2e%2f (URL-encoded ../) or %00 (null byte).
• Network: Outbound connections from the web server to unknown IPs (if RCE achieved).

Detection Engineering

YARA Rule

Sigma Rule

Suricata Rule

Remediation & Mitigation

Immediate Actions:

1. Disable the Ghost Kit plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the official patch from the vendor (nK) when available.
• Update to a patched version (currently unknown).
• Consider replacing the plugin with an alternative if no patch is forthcoming.

Valters IT Signature:

Report generated by Valters IT DevSecOps Team | CVE-2025-53567 Analysis