CVE-2025-64360

Executive Summary

CVE-2025-64360 is a PHP Local File Inclusion (LFI) vulnerability discovered in the Consulting Elementor Widgets WordPress plugin, developed by StylemixThemes. The flaw resides in improper control of a filename used in an include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The vulnerability affects all versions up to and including 1.4.2. No official patch has been released at the time of analysis.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Users who have installed the plugin from any source are at risk. Since the plugin is not an NPM, PyPI, Go, or Ruby package, supply chain risks are limited to the WordPress plugin update mechanism. However, if the plugin is bundled within a theme or a larger package, the risk propagates downstream.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Sensitive files can be read.
• Integrity Impact: None (I:N) – No file modification is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The low attack complexity and lack of authentication make this a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability is a classic PHP Local File Inclusion (LFI) stemming from the CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'). In the Consulting Elementor Widgets plugin, a PHP function (likely within a shortcode or AJAX handler) accepts a user-supplied parameter that is used directly in a require() or include() statement without proper sanitization or validation.

Root Cause: The plugin fails to validate the file path parameter, allowing directory traversal sequences (e.g., ../../) to escape the intended directory. An attacker can then include arbitrary files from the server's filesystem.

Exploitation Mechanics:

1. The attacker identifies an endpoint that accepts a file path parameter (e.g., ?file=, &template=, or a POST parameter).
2. The attacker crafts a request with a path traversal payload, such as ../../../../etc/passwd or ../../../../wp-config.php.
3. The server processes the request, and the vulnerable PHP function includes the specified file, outputting its contents to the attacker.

WordPress Ecosystem Context: This is a WordPress plugin vulnerability. The attack surface is increased because WordPress sites often have multiple plugins and themes, and LFI can be chained with other vulnerabilities (e.g., file upload) to achieve remote code execution.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical fix based on common secure coding practices.

Vulnerable Code (Example):

<?php
// consulting-elementor-widgets/includes/class-consulting-elementor-widgets.php
function load_template($template_name) {
    // No sanitization or validation
    include(plugin_dir_path(__FILE__) . 'templates/' . $template_name . '.php');
}
?>

Patched Code (Hypothetical):

<?php
function load_template($template_name) {
    // Whitelist allowed templates
    $allowed_templates = array('default', 'grid', 'list');
    $template_name = basename($template_name); // Remove path traversal
    if (in_array($template_name, $allowed_templates)) {
        include(plugin_dir_path(__FILE__) . 'templates/' . $template_name . '.php');
    } else {
        // Handle error
        wp_die('Invalid template.');
    }
}
?>

Key Differences:

• Input Validation: The patched version uses basename() to strip directory traversal sequences and a whitelist to restrict allowed values.
• Error Handling: The patched version gracefully rejects invalid input instead of blindly including a file.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Consulting Elementor Widgets <= 1.4.2 installed and activated.
• Knowledge of the vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=consulting_load_template&template=...).

Exploitation Steps:

1. Identify the vulnerable parameter: Use a web proxy or fuzzer to find parameters like template, file, include, or path in AJAX actions or shortcodes.
2. Craft the payload: Use directory traversal to read sensitive files.
   • Example: ../../../../wp-config.php
   • Example: ../../../../etc/passwd
3. Send the request:

   curl -X GET "http://target.com/wp-admin/admin-ajax.php?action=consulting_load_template&template=../../../../wp-config"
   

4. Extract data: The response will contain the contents of the included file.

Lab Setup:

• Use a local WordPress installation (e.g., via Docker or XAMPP).
• Install the vulnerable plugin version.
• Set up a web debugging proxy (Burp Suite, OWASP ZAP) to intercept and modify requests.

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for suspicious patterns:
  • Multiple ../ sequences in request parameters.
  • Requests to AJAX endpoints with unexpected parameters.
  • Unusual file paths in the Referer or User-Agent headers.
• Use a Web Application Firewall (WAF) to block path traversal attempts.

Response:

• Immediately isolate the affected server.
• Review logs for indicators of compromise (IOCs).
• If possible, disable the vulnerable plugin until a patch is applied.
• Rotate any credentials that may have been exposed (e.g., database passwords from wp-config.php).

Indicators of Compromise (IOCs)

• File Paths Accessed:
  • /etc/passwd
  • /etc/shadow
  • /wp-config.php
  • /proc/self/environ
• Log Entries:
  • GET /wp-admin/admin-ajax.php?action=consulting_load_template&template=..%2F..%2F..%2F..%2Fwp-config
  • GET /wp-content/plugins/consulting-elementor-widgets/...?file=../../../../etc/passwd
• Network Patterns:
  • Outbound connections from the web server to unknown IPs (if LFI is chained with RFI).
  • Unusual file inclusion errors in PHP error logs.

Detection Engineering

YARA Rule

rule CVE_2025_64360_LFI_Detection {
    meta:
        description = "Detects path traversal attempts targeting Consulting Elementor Widgets plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-64360"
    strings:
        $s1 = "consulting_load_template" nocase
        $s2 = "../" ascii wide
        $s3 = "wp-config.php" ascii wide
        $s4 = "/etc/passwd" ascii wide
    condition:
        $s1 and any of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2025-64360 LFI Attempt
id: 8f4a2b1c-3d5e-4f7a-9b8c-1d2e3f4a5b6c
status: experimental
description: Detects path traversal attempts in Consulting Elementor Widgets plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'action=consulting_load_template'
            - 'template=..'
            - 'file=..'
    condition: selection
falsepositives:
    - Legitimate use of nested directories (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-64360 LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=consulting_load_template"; http_uri; content:"template="; http_uri; pcre:"/template=[^&]*\.\.\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available. This is the most effective mitigation.
2. Apply a virtual patch using a WAF to block path traversal patterns (e.g., ../, ..\\, %2e%2e%2f).
3. Monitor logs for any signs of exploitation.

Long-Term Fix:

• The vendor must release a patched version that properly sanitizes file path inputs (e.g., using basename(), realpath(), or a whitelist).
• Users should update to the latest version once available.

Workarounds:

• If the plugin cannot be disabled, restrict access to the vulnerable endpoint via .htaccess or server configuration:

  <Files "admin-ajax.php">
      Require all denied
  </Files>
  

  (Note: This may break legitimate AJAX functionality.)

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.