CVE-2025-60055

Executive Summary

CVE-2025-60055 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the AncoraThemes Fabrica WordPress plugin, affecting versions up to and including 1.8.1. The vulnerability stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The CVSS score of 8.1 (High) reflects the ease of exploitation and high confidentiality impact. As of this report, no official patch is available, and no public proof-of-concept (PoC) code has been released.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the WordPress plugin repository and third-party marketplaces. Users who have installed the Fabrica plugin are at risk. Since the plugin is not an NPM, PyPI, Go, or Ruby package, standard package manager security advisories do not apply. However, the risk is amplified by the widespread use of WordPress and the plugin's potential inclusion in commercial themes.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the affected component are the same.
• Confidentiality (C): High (H) - Full file read access.
• Integrity (I): None (N) - No file modification.
• Availability (A): None (N) - No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can lead to complete compromise of the WordPress site's secrets.

Deep Dive & Mechanics

The vulnerability lies in the Fabrica plugin's handling of file includes. The plugin likely uses a user-supplied parameter (e.g., page, template, or file) to dynamically include a PHP file. Due to insufficient sanitization, an attacker can inject path traversal sequences (e.g., ../../) to include files outside the intended directory.

Example vulnerable code pattern:

$file = $_GET['file'];
include($file . '.php');

An attacker can request:

http://target.com/wp-content/plugins/fabrica/index.php?file=../../../../wp-config

This would include /var/www/html/wp-config.php (assuming the plugin is in a standard WordPress installation).

The vulnerability is classified as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), but in this case, it is limited to local file inclusion (LFI) as the description specifies "PHP Local File Inclusion."

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the fix. The vulnerable code likely uses user input directly in an include() or require() statement.

Vulnerable Code (Hypothetical):

$template = $_GET['template'];
include(plugin_dir_path(__FILE__) . 'templates/' . $template . '.php');

Patched Code (Hypothetical):

$allowed_templates = array('home', 'about', 'contact');
$template = $_GET['template'];
if (in_array($template, $allowed_templates)) {
    include(plugin_dir_path(__FILE__) . 'templates/' . $template . '.php');
} else {
    // Handle error
}

The patch would implement a whitelist of allowed files or use realpath() to resolve the path and ensure it stays within the allowed directory.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install a local WordPress instance (e.g., using Docker or XAMPP).
2. Install the Fabrica plugin version 1.8.1.
3. Identify the vulnerable parameter (e.g., file, page, template).

Exploitation Steps:

1. Basic LFI: Request a sensitive file:

   http://target/wp-content/plugins/fabrica/index.php?file=../../../../wp-config
   

2. PHP Wrapper (if enabled): Use php://filter to read source code:

   http://target/wp-content/plugins/fabrica/index.php?file=php://filter/convert.base64-encode/resource=index
   

3. Log Poisoning (if writable logs): Inject PHP code into access logs, then include the log file.

Example curl command:

curl -v "http://target/wp-content/plugins/fabrica/index.php?file=../../../../wp-config"

Blue Team (Defensive)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, ..\\, %2e%2e%2f).
• Look for requests to the Fabrica plugin directory with suspicious parameters.
• Use WAF rules to block php:// and file:// wrappers.

Hunting:

• Search for include or require statements in the Fabrica plugin code that use $_GET, $_POST, or $_REQUEST without validation.
• Check for any recent file modifications in the WordPress installation.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/fabrica/ (any file within this directory)
• URL Patterns: ?file=, ?page=, ?template= followed by path traversal sequences.
• Log Entries: HTTP requests containing ../, ..\\, %2e%2e%2f, or php://filter.
• System Files Accessed: /etc/passwd, wp-config.php, .htaccess, error_log.

Detection Engineering

YARA Rule

rule CVE_2025_60055_LFI {
    meta:
        description = "Detects attempts to exploit CVE-2025-60055 LFI in Fabrica plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60055"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\){2,}/
        $php_wrapper = /php:\/\/(filter|input|stdin)/
        $fabrica_param = /(\?|&)(file|page|template)=/
    condition:
        $fabrica_param and ($path_traversal or $php_wrapper)
}

Sigma Rule

title: CVE-2025-60055 Fabrica Plugin LFI Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects path traversal attempts targeting the Fabrica WordPress plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'file='
            - 'page='
            - 'template='
        cs-uri-query|re: '(\.\.\/|\.\.\\){2,}'
    condition: selection
falsepositives:
    - Legitimate use of similar parameters in other plugins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60055 Fabrica Plugin LFI Attempt"; flow:to_server,established; content:"/wp-content/plugins/fabrica/"; http_uri; pcre:"/(\?|&)(file|page|template)=.*(\.\.\/|\.\.\\){2,}/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Fabrica plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns and PHP wrappers.
3. Restrict file permissions on sensitive files (e.g., wp-config.php should be 600 or 640).

Long-term Fix:

• The vendor must release a patched version that implements a whitelist of allowed files or uses realpath() to validate the included file path.
• Users should monitor the plugin's update channel for a security release.

Workaround:

• If the plugin is essential, modify the vulnerable code manually to add input validation (as shown in the patched code example).

Valters IT
Securing Digital Frontiers