CVE-2025-63003

Executive Summary

CVE-2025-63003 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the WordPress ecosystem, specifically within the north-plugin developed by Fuelthemes. This plugin is a required component for the "North" theme. The vulnerability allows an unauthenticated attacker to include arbitrary local files from the server via the include() or require() PHP functions, due to improper control of a filename parameter. With a CVSS score of 7.5, this flaw can lead to sensitive information disclosure, including configuration files, database credentials, and potentially source code. As of this report, no official patch has been released, and no public proof-of-concept (PoC) exploit code is available, though the attack vector is well-understood.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository and potentially bundled with premium themes. The supply chain risk is elevated because:

• No patch available: Users cannot remediate via an update.
• Widespread use: The "North" theme and its required plugin may be installed on thousands of sites.
• No GitHub advisory: Lack of coordinated disclosure increases the window of exposure.
• EPSS Score 0.0%: This indicates low exploitation activity currently, but the risk is real and may increase once details become public.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (HIGH)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – full file read capability.
• Integrity Impact: None (I:N) – no file modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: HIGH. The vulnerability is trivial to exploit once the vulnerable parameter is identified, and it can lead to complete compromise of the WordPress site's secrets.

Deep Dive & Mechanics

The vulnerability is a classic PHP Local File Inclusion (LFI) stemming from improper sanitization of a filename passed to include() or require() functions. In the north-plugin (versions <= 1.4.2), a parameter (likely file, template, or page) is taken directly from user input (GET/POST/COOKIE) and used in a PHP include statement without proper validation or path restriction.

Example vulnerable code pattern:

$file = $_GET['file'];
include($file . '.php');

An attacker can supply a path like ../../../../etc/passwd to read arbitrary files. The .php extension appended can be bypassed using a null byte injection (in older PHP versions) or by using a path traversal with a valid extension (e.g., ../../../etc/passwd%00). In modern PHP (>=5.3.4), null byte injection is fixed, but the attacker can still read files with .php extension or use wrapper protocols like php://filter to read source code.

Attack Flow:

1. Attacker identifies a vulnerable endpoint, e.g., http://target/wp-content/plugins/north-plugin/ajax.php?file=.
2. Sends request: http://target/wp-content/plugins/north-plugin/ajax.php?file=../../../../etc/passwd.
3. Server includes the file, outputting its contents.
4. Attacker can read wp-config.php to obtain database credentials.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern and the expected fix.

Vulnerable Code (north-plugin <= 1.4.2):

// ajax.php or similar
$file = $_REQUEST['file'];
include( plugin_dir_path( __FILE__ ) . 'templates/' . $file . '.php' );

The $file is not sanitized, allowing path traversal.

Expected Patched Code:

$allowed_files = array('template1', 'template2', 'default');
$file = basename( $_REQUEST['file'] );
$file = str_replace( array( '..', '/', '\\' ), '', $file );
if ( in_array( $file, $allowed_files ) ) {
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $file . '.php' );
} else {
    // error or default
}

The fix should whitelist allowed filenames and strip path traversal characters.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with north-plugin version <= 1.4.2 installed and active.
• Knowledge of the vulnerable parameter (e.g., file, template, page).

Exploitation Steps:

1. Identify vulnerable endpoint: Use a web scanner or manually test common parameters.
2. Craft LFI payload: Use path traversal to read sensitive files.

   curl "http://target/wp-content/plugins/north-plugin/ajax.php?file=../../../../etc/passwd"
   

3. Read wp-config.php:

   curl "http://target/wp-content/plugins/north-plugin/ajax.php?file=../../../../wp-config"
   

   (Note: The .php extension may be appended; try without extension or use php://filter to bypass.)
4. Use PHP wrappers (if allow_url_include is off, php://filter works):

   curl "http://target/wp-content/plugins/north-plugin/ajax.php?file=php://filter/convert.base64-encode/resource=../../../../wp-config"
   

5. Decode base64 output to get the file contents.

Lab Setup:

• Install WordPress locally (e.g., using Docker).
• Install the vulnerable north-plugin version 1.4.2.
• Create a test page that triggers the include.
• Use Burp Suite or cURL to send malicious requests.

Blue Team (Detection & Response)

Detection Steps:

1. Monitor web server logs for suspicious patterns:
   • Requests containing ../, ..\\, %2e%2e%2f, %252e%252e%252f.
   • Requests to plugin files with file= parameter.
   • Base64-encoded strings in request parameters.
2. Check for outbound connections from the web server (if LFI leads to RCE).
3. Review file integrity of wp-config.php and other sensitive files.

Response:

• Immediately isolate the affected server.
• Disable the vulnerable plugin via wp-cli or by renaming its directory.
• Rotate all secrets (database passwords, salts, API keys).
• Conduct forensic analysis to determine if files were exfiltrated.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests with file=../../../../etc/passwd or similar patterns.
• Requests containing php://filter in the file parameter.
• Unusual base64-encoded strings in response bodies.

File System IOCs:

• Unexpected access to /etc/passwd, /etc/shadow, wp-config.php.
• Modified or new files in the plugin directory (if RCE achieved).

Log IOCs:

• Web server logs showing 404 or 200 responses to non-existent template files.
• PHP error logs with include(): Failed opening messages.

Detection Engineering

YARA Rule

rule CVE_2025_63003_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting north-plugin CVE-2025-63003"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63003"
    strings:
        $lfi1 = "file=../" ascii wide nocase
        $lfi2 = "file=..\\" ascii wide nocase
        $lfi3 = "file=%2e%2e%2f" ascii wide nocase
        $lfi4 = "file=php://" ascii wide nocase
        $plugin_path = "/wp-content/plugins/north-plugin/" ascii wide nocase
    condition:
        any of ($lfi*) and $plugin_path
}

Sigma Rule

title: CVE-2025-63003 LFI Attempt Against North Plugin
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in HTTP requests targeting the north-plugin.
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-63003
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'file=../'
            - 'file=..\\'
            - 'file=%2e%2e%2f'
            - 'file=php://'
        cs-uri-stem|contains: '/wp-content/plugins/north-plugin/'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-63003 LFI Attempt Against North Plugin"; flow:to_server,established; content:"/wp-content/plugins/north-plugin/"; http_uri; content:"file="; http_uri; pcre:"/(file=\.\.\/|file=\.\.\\|file=%2e%2e%2f|file=php:\/\/)/i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Rename the north-plugin directory via FTP or WP-CLI:

   wp plugin deactivate north-plugin
   

2. Apply virtual patching: Use a Web Application Firewall (WAF) to block requests containing file=../ or file=php:// in the query string.
3. Upgrade PHP: Ensure PHP version is >= 5.3.4 to prevent null byte injection (though not a complete fix).

Long-term Fix:

• Monitor the vendor's website for an official patch.
• If no patch is released, consider replacing the "North" theme and its plugin with an alternative.
• Implement input validation and whitelisting for all file inclusion parameters.

Workaround Code (if you must keep the plugin): Add the following to your theme's functions.php to sanitize the parameter:

add_action('init', function() {
    if (isset($_GET['file'])) {
        $_GET['file'] = basename(str_replace(array('..', '/', '\\'), '', $_GET['file']));
    }
});

Valters IT
Securing Digital Ecosystems