CVE-2025-54750

Executive Summary

CVE-2025-54750 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Funnel Builder by FunnelKit WordPress plugin, affecting versions up to and including 3.11.1. The vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to the disclosure of sensitive information such as configuration files, database credentials, and source code. The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). As a WordPress plugin vulnerability, it directly impacts the WordPress ecosystem and does not involve Apache or Nginx misconfigurations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. The supply chain risk is elevated because:

• No official patch has been released as of the analysis date.
• The plugin is widely used for sales funnel creation, making it a high-value target.
• Attackers can leverage this LFI to pivot to other plugins or the WordPress core, potentially leading to full site compromise.

CVSS Breakdown & Threat Level

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Base Score: 7.5 (High)

• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions are required.
• Privileges Required (PR): None – No authentication needed.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The exploit does not affect other components.
• Confidentiality (C): High – Sensitive files can be read.
• Integrity (I): None – No file modification possible.
• Availability (A): None – No denial of service.

Threat Level: High. The combination of network exploitability, low complexity, and no authentication makes this a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability exists in the Funnel Builder plugin's handling of file inclusion. The plugin likely uses a parameter (e.g., include_file, template, or similar) to dynamically load PHP files for rendering funnel pages. Due to insufficient sanitization, an attacker can inject path traversal sequences (e.g., ../../) to include arbitrary files from the server.

Root Cause: The plugin fails to validate or sanitize the filename parameter before passing it to PHP functions like include(), require(), or file_get_contents(). This allows an attacker to specify a path outside the intended directory.

Exploitation Scenario:

1. An attacker sends a crafted HTTP request to a vulnerable endpoint, such as:

   GET /wp-content/plugins/funnel-builder/frontend/index.php?include_file=../../../../etc/passwd HTTP/1.1
   

2. The plugin includes the specified file, outputting its contents in the response.
3. The attacker can then read sensitive files like wp-config.php (database credentials), .htaccess, or other PHP source code.

Impact: Full disclosure of server-side files, leading to potential credential theft, privilege escalation, and lateral movement within the hosting environment.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common LFI fixes.

Vulnerable Code (funnel-builder/frontend/index.php):

<?php
$file = $_GET['include_file'];
include($file . '.php');
?>

Patched Code (Hypothetical):

<?php
$allowed_files = array('template1', 'template2', 'template3');
$file = $_GET['include_file'];
if (in_array($file, $allowed_files)) {
    include(__DIR__ . '/templates/' . $file . '.php');
} else {
    // Log attempt and return error
    error_log('Unauthorized file inclusion attempt: ' . $file);
    http_response_code(403);
    echo 'Access denied.';
}
?>

Key Differences:

• Whitelist approach: Only predefined filenames are allowed.
• Path restriction: The include path is hardcoded to a specific directory.
• Error handling: Unauthorized attempts are logged and blocked.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Funnel Builder plugin version <= 3.11.1.
• No authentication required.

Exploit Steps:

1. Identify the vulnerable endpoint. Common patterns include:
   • /wp-content/plugins/funnel-builder/frontend/index.php?include_file=...
   • /wp-content/plugins/funnel-builder/includes/class-funnel.php?load=...
2. Use path traversal to read sensitive files:

   curl "http://target.com/wp-content/plugins/funnel-builder/frontend/index.php?include_file=../../../../etc/passwd"
   

3. Extract database credentials from wp-config.php:

   curl "http://target.com/wp-content/plugins/funnel-builder/frontend/index.php?include_file=../../../../wp-config"
   

   (Note: The .php extension may be appended automatically; adjust accordingly.)

Lab Setup:

• Use a local WordPress installation with Docker:

  docker run --name wp-funnel -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=wpuser -e WORDPRESS_DB_PASSWORD=wppass -e WORDPRESS_DB_NAME=wpdb -p 8080:80 -d wordpress
  

• Install Funnel Builder plugin version 3.11.1 manually.
• Test the exploit against the local instance.

Blue Team (Detection & Prevention)

Detection:

• Monitor web server logs for suspicious include_file parameters containing ../ or absolute paths.
• Look for requests to plugin files with unusual query strings.
• Use WAF rules to block path traversal patterns.

Prevention:

• Apply the principle of least privilege to the web server user.
• Disable PHP allow_url_include and allow_url_fopen if not needed.
• Implement a Web Application Firewall (WAF) with rules to block LFI attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing include_file=, load=, or template= with path traversal sequences (e.g., ../, ..\\, %2e%2e%2f).
• Outbound connections from the web server to unknown IPs (if RFI is also possible).
• Unusual file reads in server logs (e.g., /etc/passwd, /etc/shadow, wp-config.php).

File System IOCs:

• Presence of unexpected files in the web root (e.g., shell.php, cmd.php).
• Modified timestamps on core WordPress files.
• New entries in wp-content/debug.log indicating failed include attempts.

Log IOCs:

• Apache/Nginx access logs with 200 responses to LFI payloads.
• PHP error logs showing include(): Failed opening messages for unexpected paths.

Detection Engineering

YARA Rule

rule CVE_2025_54750_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting Funnel Builder plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-54750"
    strings:
        $s1 = "include_file=" nocase
        $s2 = "load=" nocase
        $s3 = "template=" nocase
        $s4 = "../" nocase
        $s5 = "..\\" nocase
        $s6 = "%2e%2e%2f" nocase
        $s7 = "wp-config" nocase
        $s8 = "/etc/passwd" nocase
    condition:
        any of ($s1, $s2, $s3) and any of ($s4, $s5, $s6, $s7, $s8)
}

Sigma Rule

title: Funnel Builder LFI Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in Funnel Builder plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'include_file='
            - 'load='
            - 'template='
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - '/etc/passwd'
            - 'wp-config'
    condition: selection
falsepositives:
    - Legitimate use of similar parameters in other plugins
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-54750 Funnel Builder LFI Attempt";
    flow:to_server,established;
    content:"include_file="; http_uri; nocase;
    content:"../"; http_uri; distance:0;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement a WAF rule to block requests containing include_file, load, or template parameters with path traversal patterns.
3. Restrict file permissions on sensitive files (e.g., wp-config.php should be readable only by the web server user).

Long-term Fix:

• Apply the official patch once released by FunnelKit.
• If patching is not possible, consider replacing the plugin with an alternative.

Workaround:

• Add the following to .htaccess to block LFI attempts:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (include_file|load|template)=.*\.\..* [NC]
  RewriteRule .* - [F,L]
  

Monitoring:

• Enable detailed logging for all plugin-related requests.
• Set up alerts for multiple failed LFI attempts from the same IP.

Valters IT