CVE-2025-60193

Executive Summary

CVE-2025-60193 is a PHP Local File Inclusion (LFI) vulnerability in the Premmerce User Roles WordPress plugin, affecting versions up to and including 1.0.13. The vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The CVSS score is 7.5 (High), with a network attack vector and no authentication required. No public exploit code or proof-of-concept is currently available, and the patch status is unknown.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the WordPress dashboard or via direct download are at risk. The supply chain risk is moderate, as the plugin is not a core dependency but is widely used for user role management. No malicious commits or backdoors have been reported in the plugin’s source code.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability allows unauthenticated file disclosure, which can lead to credential theft and lateral movement.

Deep Dive & Mechanics

The vulnerability exists in the plugin’s file inclusion mechanism, likely in a function that dynamically constructs a file path based on user input (e.g., via a page or tab parameter). The plugin fails to sanitize or validate the filename, allowing path traversal sequences like ../../ to escape the intended directory. For example, a request such as:

/wp-admin/admin.php?page=premmerce-user-roles&tab=../../../../etc/passwd

could cause the PHP include() or require() function to load /etc/passwd instead of a legitimate plugin template. The attacker can read any file readable by the web server user (e.g., www-data), including wp-config.php, .htaccess, and log files.

The vulnerability is classified as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), but in this case it is a Local File Inclusion because the attacker is restricted to files on the same server (no remote URL inclusion is possible due to allow_url_include being typically disabled).

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical example based on plugin logic):

$tab = $_GET['tab'];
include( plugin_dir_path( __FILE__ ) . 'templates/' . $tab . '.php' );

The $tab parameter is directly concatenated into the file path without sanitization.

Patched Code (expected fix):

$allowed_tabs = array( 'general', 'roles', 'capabilities' );
$tab = $_GET['tab'];
if ( in_array( $tab, $allowed_tabs ) ) {
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $tab . '.php' );
} else {
    // Handle invalid tab
}

The patched version uses a whitelist of allowed values, preventing path traversal.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Premmerce User Roles plugin version <= 1.0.13.
• Network access to the admin area (or any page that includes the vulnerable parameter).

Exploitation Steps:

1. Identify the vulnerable parameter (likely tab or page in the admin URL).
2. Craft a request to read sensitive files:

curl -k "https://target.com/wp-admin/admin.php?page=premmerce-user-roles&tab=../../../../etc/passwd"

3. If successful, the response will contain the contents of /etc/passwd.
4. To read wp-config.php:

curl -k "https://target.com/wp-admin/admin.php?page=premmerce-user-roles&tab=../../../../wp-config"

Note: The .php extension is appended automatically, so the attacker must omit it.

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for requests containing ../ or ..%2f in the tab parameter.
• Look for unusual file paths in the response body (e.g., root:x:0:0:root).

Hardening:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Restrict file permissions so that wp-config.php is not readable by the web server user.

Indicators of Compromise (IOCs)

• URL Patterns: tab=..%2f..%2f..%2f..%2fetc/passwd or similar.
• Log Entries: GET /wp-admin/admin.php?page=premmerce-user-roles&tab=../../../../etc/passwd
• Response Content: Presence of system files like /etc/passwd, /etc/shadow, or database credentials.
• File System Changes: Unexpected files in the plugin’s template directory.

Detection Engineering

YARA Rule

rule premmerce_lfi_detection {
    meta:
        description = "Detects attempts to exploit CVE-2025-60193 LFI in Premmerce User Roles"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60193"
    strings:
        $path_traversal = /tab=\.\.(\/|%2f)/
        $sensitive_file = /(etc\/passwd|wp-config\.php|\.\.\/\.\.\/)/
    condition:
        $path_traversal and $sensitive_file
}

Sigma Rule

title: Premmerce User Roles LFI Exploitation Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-60193
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 'tab=..'
    condition: selection
falsepositives:
    - Legitimate use of '..' in parameter values (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60193 Premmerce User Roles LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin.php"; http_uri; content:"tab="; http_uri; pcre:"/tab=\.\.(\/|%2f)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patched version is released.
2. Implement a WAF rule to block path traversal patterns in the tab parameter.
3. Review server logs for signs of exploitation.

Long-term Fix:

• The vendor must release a patched version that uses a whitelist of allowed file names.
• Users should update to the latest version once available.

Workaround:

• If the plugin cannot be disabled, modify the plugin code to add input validation (see patched code example above).

Valters IT