CVE-2025-63017

Executive Summary

CVE-2025-63017 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Fuelthemes WerkStatt Plugin for WordPress, affecting versions up to and including 1.6.6. The vulnerability stems from improper control of a filename used in an include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The CVSS score is 7.5 (High), and no official patch has been released by the vendor. The EPSS score is 0.0%, indicating low exploitation activity at the time of analysis, but the risk remains significant for unpatched installations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository and third-party marketplaces. Users are advised to verify the integrity of their plugin files and consider removing the plugin if no update is available. The lack of a patch from the vendor increases supply chain risk, as malicious actors could exploit this in compromised or outdated installations.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The vulnerability is easily exploitable remotely without authentication, making it a high-priority threat for WordPress sites using the WerkStatt plugin.

Deep Dive & Mechanics

The vulnerability exists in the WerkStatt plugin's PHP code, where a user-supplied parameter is used directly in a PHP include() or require() statement without proper sanitization or validation. This allows an attacker to manipulate the file path to include arbitrary files from the server's filesystem.

Root Cause: The plugin likely uses a parameter like ?file= or ?page= to load template files or content. The code does not restrict the path to a specific directory or validate the file extension, enabling path traversal attacks (e.g., ../../wp-config.php).

Exploitation Scenario:

1. An attacker sends a crafted HTTP request to the vulnerable endpoint.
2. The request includes a path traversal sequence to read sensitive files.
3. The server includes the file, outputting its contents in the response.

Impact:

• Disclosure of database credentials from wp-config.php.
• Reading of other sensitive files (e.g., /etc/passwd).
• Potential for remote code execution if combined with file upload or log poisoning.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical comparison based on common LFI fixes.

Vulnerable Code (Example):

<?php
$file = $_GET['file'];
include($file . '.php');
?>

Patched Code (Example):

<?php
$allowed_files = array('home', 'about', 'contact');
$file = $_GET['file'];
if (in_array($file, $allowed_files)) {
    include('templates/' . $file . '.php');
} else {
    // Handle error
}
?>

The patched version uses a whitelist of allowed files and restricts the include path to a specific directory, preventing path traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress with the WerkStatt plugin version 1.6.6.
2. Ensure the plugin is active and accessible.

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., file, page, template).
2. Send a request to read wp-config.php:

   GET /wp-content/plugins/werkstatt-plugin/vulnerable.php?file=../../../wp-config HTTP/1.1
   Host: target.com
   

3. The server will include the file and output its contents.

Proof of Concept (PoC):

curl -v "http://target.com/wp-content/plugins/werkstatt-plugin/vulnerable.php?file=../../../wp-config"

Blue Team (Defensive)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, ..\\).
• Look for requests to the plugin's PHP files with suspicious parameters.

Mitigation:

• Disable or remove the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) rule to block path traversal attempts.
• Restrict file permissions on sensitive files like wp-config.php.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/werkstatt-plugin/ (any PHP file within)
• URL Patterns: ?file=, ?page=, ?template= followed by ../ sequences
• Log Entries: HTTP requests containing %2e%2e%2f (URL-encoded ../) or ..%2f
• Response Content: Unexpected inclusion of system files (e.g., /etc/passwd, wp-config.php)

Detection Engineering

YARA Rule

rule CVE_2025_63017_LFI {
    meta:
        description = "Detects LFI attempts against WerkStatt plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-63017"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\)/
        $plugin_path = /werkstatt-plugin/
        $param = /(\?|&)(file|page|template)=/
    condition:
        $plugin_path and $param and $path_traversal
}

Sigma Rule

title: CVE-2025-63017 WerkStatt Plugin LFI Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit LFI in WerkStatt plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        c-uri|contains:
            - 'werkstatt-plugin'
            - 'file='
            - 'page='
            - 'template='
        c-uri|contains|all:
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other plugins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-63017 WerkStatt Plugin LFI Attempt"; flow:to_server,established; content:"werkstatt-plugin"; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable and remove the WerkStatt plugin from all WordPress installations until a patch is released.
2. Alternative: If the plugin is critical, implement a WAF rule to block path traversal patterns.
3. Long-term: Monitor the vendor's website for updates. Consider switching to an alternative plugin.
4. Hardening: Ensure WordPress core, themes, and other plugins are up to date. Restrict file permissions on sensitive files.

Valters IT
Securing Digital Frontiers