CVE-2025-60194

Executive Summary

CVE-2025-60194 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Premmerce Product Search for WooCommerce WordPress plugin, affecting versions up to and including 2.2.4. The vulnerability stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially enabling further server-side attacks if combined with file upload capabilities.

The vulnerability is classified under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), though the actual exploitation is limited to local file inclusion (LFI) due to the plugin's context. The CVSS v3.1 base score is 7.5 (High), with the attack vector being network-based, low complexity, and requiring no privileges or user interaction. The impact is primarily on confidentiality, as an attacker can read sensitive files but cannot directly modify data or execute code.

As this is a WordPress plugin vulnerability, it is critical for site administrators to immediately assess their exposure. The patch status is currently unknown, and no public exploit code or proof-of-concept is available at this time. However, the nature of LFI vulnerabilities makes them highly exploitable once the vulnerable parameter is identified.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and potentially through third-party marketplaces. As a supply chain risk, any site using the Premmerce Product Search for WooCommerce plugin version 2.2.4 or earlier is vulnerable. The lack of a patch means that users must either implement virtual patching through a Web Application Firewall (WAF) or disable the plugin until a fix is released. Organizations should audit their WordPress plugin inventory and ensure that only trusted, actively maintained plugins are in use.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or complex attack sequences are required.
• Privileges Required (PR): None – No authentication is needed to exploit.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploitation does not affect other components.
• Confidentiality (C): High – Sensitive files can be read.
• Integrity (I): None – No file modification is possible.
• Availability (A): None – No denial of service impact.

Threat Level: High. The combination of network exploitability, low complexity, and no required privileges makes this a prime target for automated scanning and exploitation. The potential to read wp-config.php exposes database credentials, which can lead to complete site compromise.

Deep Dive & Mechanics

The vulnerability resides in the Premmerce Product Search for WooCommerce plugin, which provides enhanced search functionality for WooCommerce stores. The plugin likely uses a PHP include or require statement to load template files or other resources based on user-supplied input. The improper control of the filename allows an attacker to manipulate the path, enabling directory traversal.

Root Cause: The plugin fails to sanitize or validate the filename parameter before passing it to a PHP include function. For example, a vulnerable code snippet might look like:

include( $_GET['template'] . '.php' );

An attacker can supply a path like ../../../../etc/passwd to read arbitrary files, or use null byte injection (though deprecated in PHP 5.3+) to bypass extension appending.

Exploitation Scenario:

1. An attacker identifies a vulnerable endpoint, e.g., /?premmerce_search_template=something.
2. The attacker crafts a request: /?premmerce_search_template=../../../../wp-config.
3. The plugin includes the file ../../../../wp-config.php, exposing database credentials.
4. The attacker can then use these credentials to access the database, potentially leading to full site takeover.

WordPress Ecosystem Context: As a WordPress plugin, this vulnerability is particularly dangerous because WordPress sites often have predictable file paths and sensitive files like wp-config.php in known locations. The plugin's integration with WooCommerce also means that e-commerce data (customer PII, order details) could be at risk if the attacker escalates.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common remediation patterns.

Vulnerable Code (hypothetical):

// premmerce-search/includes/class-search.php
public function load_template( $template_name ) {
    $template_path = plugin_dir_path( __FILE__ ) . 'templates/' . $template_name . '.php';
    if ( file_exists( $template_path ) ) {
        include( $template_path );
    }
}

In this example, $template_name is taken directly from user input (e.g., $_GET['template']), allowing directory traversal.

Patched Code (hypothetical):

// premmerce-search/includes/class-search.php
public function load_template( $template_name ) {
    // Whitelist allowed templates
    $allowed_templates = array( 'default', 'grid', 'list' );
    if ( ! in_array( $template_name, $allowed_templates ) ) {
        return;
    }
    $template_path = plugin_dir_path( __FILE__ ) . 'templates/' . $template_name . '.php';
    if ( file_exists( $template_path ) ) {
        include( $template_path );
    }
}

The patched version uses a whitelist to restrict the $template_name to predefined values, preventing any path traversal.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Premmerce Product Search for WooCommerce <= 2.2.4 installed and activated.
• Knowledge of the vulnerable parameter (e.g., template, file, include). This can be discovered through fuzzing or code review.

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a web proxy or curl to test common parameters.

   curl -v "http://target.com/?premmerce_search_template=../../../../etc/passwd"
   

2. Read sensitive files: Attempt to read wp-config.php to extract database credentials.

   curl -v "http://target.com/?premmerce_search_template=../../../../wp-config"
   

   Note: The .php extension may be appended automatically, so the request should omit it.
3. Extract credentials: Parse the response for DB_NAME, DB_USER, DB_PASSWORD, and DB_HOST.
4. Escalate: Use the credentials to connect to the database and extract user data, or upload a malicious plugin/theme.

Lab Setup:

• Use a local WordPress installation with Docker:

  docker run --name wp-premmerce -e WORDPRESS_DB_HOST=db -e WORDPRESS_DB_USER=root -e WORDPRESS_DB_PASSWORD=example -e WORDPRESS_DB_NAME=wordpress -p 8080:80 -d wordpress
  

• Install the vulnerable plugin manually by downloading version 2.2.4 from the WordPress plugin repository or a mirror.
• Activate the plugin and test the vulnerability.

Blue Team (Detection & Defense)

Detection:

• Monitor web server logs for suspicious ../ patterns in query parameters.
• Look for requests to wp-config.php or /etc/passwd via the plugin's endpoints.
• Use a WAF to block directory traversal attempts.

Defense:

• Disable the plugin immediately if no patch is available.
• Implement virtual patching via WAF rules (e.g., ModSecurity).
• Restrict file permissions on sensitive files (e.g., wp-config.php should be 600).
• Use a security plugin like Wordfence to monitor file inclusion attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing premmerce_search_template parameter with path traversal sequences (e.g., ../, ..\\, %2e%2e%2f).
• Requests to non-existent template files like ../../../../etc/passwd or ../../../../wp-config.
• Unusual 200 OK responses for requests that should return 404 (e.g., reading system files).

File System IOCs:

• Unexpected inclusion of files outside the plugin's template directory.
• Modified or newly created files in the WordPress installation (if LFI is combined with file upload).

Log IOCs:

• Web server access logs showing repeated attempts with ../ patterns.
• PHP error logs indicating failed include attempts or warnings about open_basedir restrictions.

Detection Engineering

YARA Rule

rule CVE_2025_60194_LFI_Detection {
    meta:
        description = "Detects attempts to exploit CVE-2025-60194 in Premmerce Product Search for WooCommerce"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60194"
    strings:
        $param = "premmerce_search_template" nocase
        $traversal1 = "../" ascii
        $traversal2 = "..\\" ascii
        $traversal3 = "%2e%2e%2f" ascii
        $sensitive1 = "wp-config" nocase
        $sensitive2 = "/etc/passwd" ascii
    condition:
        $param and any of ($traversal*) and any of ($sensitive*)
}

Sigma Rule

title: CVE-2025-60194 Premmerce Product Search LFI Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit PHP Local File Inclusion in Premmerce Product Search for WooCommerce
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'premmerce_search_template='
            - '../'
            - '..\\'
            - '%2e%2e%2f'
            - 'wp-config'
            - '/etc/passwd'
    condition: selection
falsepositives:
    - Legitimate use of similar parameters in other plugins (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-60194 Premmerce Product Search LFI Attempt"; flow:to_server,established; content:"premmerce_search_template"; http_uri; nocase; content:"../"; http_uri; distance:0; content:"wp-config"; http_uri; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if it is not critical for business operations.
2. Implement virtual patching using a WAF to block requests containing premmerce_search_template with path traversal sequences.
3. Monitor logs for exploitation attempts and investigate any successful hits.

Long-term Fix:

• Wait for the vendor to release a patched version. If no patch is forthcoming, consider replacing the plugin with an alternative.
• Apply the principle of least privilege to the web server user to limit the impact of LFI.
• Use a security plugin that provides file integrity monitoring and intrusion detection.

Configuration Hardening:

• Set open_basedir in php.ini to restrict file access to the WordPress directory.
• Disable allow_url_include and allow_url_fopen if not needed.
• Ensure wp-config.php is not readable by the web server user (chmod 600).

Valters IT
Securing Digital Frontiers