CVE-2025-60191

Executive Summary

CVE-2025-60191 is a critical PHP Local File Inclusion (LFI) vulnerability in the Premmerce Wishlist for WooCommerce WordPress plugin, affecting versions up to and including 1.1.10. The vulnerability stems from improper control of filenames used in PHP include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading /etc/passwd, WordPress configuration files (wp-config.php), or other sensitive data. The CVSS score is 7.5 (High), with a network attack vector and no authentication required. No public proof-of-concept (PoC) or exploit code has been released, and the vendor has not provided a patch.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users should verify the integrity of their plugin files and monitor for updates. Since no patch is available, immediate mitigation involves disabling the plugin or applying virtual patching via a Web Application Firewall (WAF).

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full file read capability.
• Integrity Impact: None (I:N) – No file modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is easy to exploit and can lead to complete disclosure of sensitive server files, including database credentials from wp-config.php.

Deep Dive & Mechanics

The vulnerability exists in the premmerce-woocommerce-wishlist plugin, specifically in how it handles file inclusion for template or configuration files. The plugin likely uses user-supplied input (e.g., via GET/POST parameters) to construct a file path for PHP's include() or require() functions without proper sanitization or validation. An attacker can manipulate this input to traverse directories and include arbitrary files from the server.

Root Cause: The plugin fails to validate or sanitize the filename parameter before passing it to an include/require statement. This allows path traversal sequences like ../../../../etc/passwd to be injected.

Attack Vector: An unauthenticated attacker sends a crafted HTTP request to a vulnerable endpoint (e.g., ?page=../../../../etc/passwd%00 or similar). The plugin then includes the specified file, outputting its contents to the attacker.

Impact: Successful exploitation allows reading any file on the server that the web server user has access to, including:

• /etc/passwd (user enumeration)
• /etc/shadow (if permissions allow)
• wp-config.php (database credentials, salts, keys)
• Source code of other plugins/themes
• System logs

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be something like:

// Vulnerable code (hypothetical)
$file = $_GET['file'];
include( $file . '.php' );

A patched version would implement strict validation:

// Patched code (hypothetical)
$allowed_files = array('template1', 'template2');
$file = $_GET['file'];
if (in_array($file, $allowed_files, true)) {
    include( $file . '.php' );
} else {
    // Error handling
}

Key Differences:

• Vulnerable: Direct use of user input in include/require without validation.
• Patched: Whitelist-based validation or use of realpath() to resolve and restrict paths.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target running WordPress with Premmerce Wishlist for WooCommerce <= 1.1.10.
• No authentication required.

Exploitation Steps:

1. Identify vulnerable endpoint: Look for parameters like page, file, template, or include in the plugin's URLs. Example: /?page=something.

2. Craft payload: Use path traversal to read sensitive files. For example:

   GET /?page=../../../../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. Execute: Send the request. If successful, the response will contain the contents of /etc/passwd.

Example using cURL:

curl -v "http://target.com/?page=../../../../../../etc/passwd"

Advanced: Use null byte injection (if PHP < 5.3.4) or other techniques to bypass extensions:

GET /?page=../../../../../../etc/passwd%00

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious GET parameters containing ../ or %00.
• Look for requests to plugin-specific endpoints with unusual file paths.

Mitigation:

• Disable the plugin immediately if not critical.
• Apply virtual patching via WAF rules to block path traversal patterns.
• Restrict file permissions on sensitive files (e.g., wp-config.php should be 600).

Hunting:

• Search logs for page=, file=, or template= parameters with directory traversal sequences.
• Check for outbound connections from the web server to unknown IPs (data exfiltration).

Indicators of Compromise (IOCs)

• Network:

  • HTTP requests containing ../ or %00 in parameters like page, file, template.
  • Unusual file paths in request URIs (e.g., /etc/passwd, /wp-config.php).

• File System:

  • Unexpected access to /etc/passwd, /etc/shadow, or wp-config.php by the web server user.
  • Modified plugin files (if attacker uploads a webshell).

• Logs:

  • Web server access logs showing 200 responses to path traversal attempts.
  • PHP error logs with "failed to open stream" or "No such file" messages.

Detection Engineering

YARA Rule

rule CVE_2025_60191_LFI_Detection {
    meta:
        description = "Detects attempts to exploit CVE-2025-60191 in Premmerce Wishlist for WooCommerce"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "high"
    strings:
        $path_traversal = /(\.\.\/){2,}(etc\/passwd|wp-config\.php|proc\/self\/environ)/
        $plugin_param = /[?&](page|file|template)=/
    condition:
        $plugin_param and $path_traversal
}

Sigma Rule

title: CVE-2025-60191 Premmerce Wishlist LFI Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit PHP Local File Inclusion in Premmerce Wishlist for WooCommerce
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'page='
            - 'file='
            - 'template='
        cs-uri-query|re: '(\.\.\/){2,}(etc\/passwd|wp-config\.php|proc\/self\/environ)'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60191 Premmerce Wishlist LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"page="; http_uri; pcre:"/(\.\.\/){2,}(etc\/passwd|wp-config\.php|proc\/self\/environ)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential for business operations.
2. Apply virtual patching using a WAF to block path traversal patterns (e.g., ../, %00).
3. Restrict file permissions on sensitive files (e.g., chmod 600 wp-config.php).

Long-term Fix:

• Monitor the plugin's official page for a security update. If no patch is released, consider replacing the plugin with an alternative.
• Implement input validation and whitelisting for all file inclusion parameters in custom code.

Detection:

• Deploy the provided YARA, Sigma, and Suricata rules to detect exploitation attempts.
• Regularly review web server logs for suspicious activity.

Valters IT Signature

This report was generated by Valters IT Cyber Threat Intelligence. For questions, contact intelligence@valters.it.