CVE-2025-8575

Executive Summary

CVE-2025-8575 is a critical arbitrary file deletion vulnerability discovered in the LWS Cleaner plugin for WordPress, affecting all versions up to and including 2.4.1.3. The flaw resides in the lws_cl_delete_file function, which performs insufficient validation of file paths. An authenticated attacker with Administrator-level privileges can exploit this to delete arbitrary files on the server, including critical configuration files like wp-config.php. Deleting such files can lead to a denial of service or, more critically, remote code execution (RCE) if the attacker can then upload a malicious file or trigger a reinstallation process. The vulnerability is classified as a Path Traversal (CWE-22) issue, and while the CVSS score is 7.2 (High), the potential for RCE elevates the real-world risk significantly.

WordPress Ecosystem Context

This vulnerability is specific to the LWS Cleaner plugin, a utility designed to clean up WordPress installations. As a WordPress plugin, it operates within the WordPress application stack and is not related to Apache or Nginx server software. The attack vector requires administrative access, but given the prevalence of shared hosting and multi-site environments, a compromised admin account on one site could cascade to others.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required; the function is directly callable.
• Privileges Required (PR): High (H) – Administrator-level access is needed.
• User Interaction (UI): None (N) – No user action is required beyond the attacker's actions.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): High (H) – Deletion of configuration files can expose sensitive data.
• Integrity (I): High (H) – Arbitrary file deletion compromises system integrity.
• Availability (A): High (H) – Deleting critical files can cause a denial of service.

Threat Level: High. While the CVSS score is 7.2, the ease of exploitation (low complexity) and potential for RCE escalation make this a critical priority for patching.

Deep Dive & Mechanics

The vulnerability is rooted in the lws_cl_delete_file function within the LWS Cleaner plugin. This function is intended to delete temporary or cache files created by the plugin. However, it fails to properly sanitize or validate the file path provided by the user. Specifically, it does not check for path traversal sequences (e.g., ../) or ensure that the target file is within an allowed directory.

Attack Flow:

1. An authenticated administrator accesses the plugin's admin interface.
2. The attacker crafts a request to the lws_cl_delete_file function with a malicious file path, such as ../../wp-config.php.
3. The function passes this path directly to PHP's unlink() or similar file deletion function without validation.
4. The server deletes the specified file, potentially causing a denial of service or enabling further exploitation.

Why RCE is Possible: Deleting wp-config.php forces WordPress to attempt a fresh installation, which can be exploited if the attacker can control the database connection parameters during the reinstallation process. Alternatively, deleting a critical PHP file could allow the attacker to upload a malicious replacement.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.4.1.3):

function lws_cl_delete_file($file_path) {
    // No validation of $file_path
    if (file_exists($file_path)) {
        unlink($file_path);
        return true;
    }
    return false;
}

Patched Code (Hypothetical Fix):

function lws_cl_delete_file($file_path) {
    // Define allowed directory
    $allowed_dir = WP_CONTENT_DIR . '/uploads/lws-cleaner/';
    // Resolve real path to prevent traversal
    $real_path = realpath($file_path);
    // Check if the resolved path starts with the allowed directory
    if (strpos($real_path, $allowed_dir) === 0 && file_exists($real_path)) {
        unlink($real_path);
        return true;
    }
    return false;
}

The patched version uses realpath() to resolve any path traversal sequences and then verifies that the resulting path is within the intended directory.

Exploitation & Lab Setup

Red Team (Attacker) Perspective

Prerequisites:

• Administrator-level credentials to the WordPress admin panel.
• Network access to the WordPress instance.

Exploitation Steps:

1. Log in to WordPress as an administrator.
2. Navigate to the LWS Cleaner plugin settings (typically under Tools or Settings).
3. Intercept the request to the lws_cl_delete_file function using a proxy like Burp Suite.
4. Modify the file_path parameter to target a critical file, e.g., ../../wp-config.php.
5. Send the request. The server will delete the file.

Example HTTP Request:

POST /wp-admin/admin-ajax.php HTTP/1.1
Host: target-wordpress-site.com
Content-Type: application/x-www-form-urlencoded
Cookie: [admin session cookie]

action=lws_cl_delete_file&file_path=../../wp-config.php

Post-Exploitation: After deleting wp-config.php, the attacker can trigger a WordPress reinstallation by accessing the site's root URL. During reinstallation, the attacker can specify a malicious database server to gain RCE.

Blue Team (Defender) Perspective

Detection:

• Monitor for unusual file deletion operations, especially targeting wp-config.php, .htaccess, or other critical files.
• Look for HTTP requests to admin-ajax.php with the action=lws_cl_delete_file parameter.
• Audit admin user activity for suspicious file path manipulations.

Hunting:

• Search logs for unlink() calls with paths containing ../ or other traversal patterns.
• Use file integrity monitoring (FIM) tools to alert on deletion of critical files.

Lab Setup:

• Deploy a WordPress instance with LWS Cleaner 2.4.1.3.
• Create a non-privileged admin account for testing.
• Use a web application firewall (WAF) to block path traversal attempts.

Indicators of Compromise (IOCs)

• File Paths: ../../wp-config.php, ../../.htaccess, ../../wp-content/plugins/lws-cleaner/
• HTTP Requests: POST to /wp-admin/admin-ajax.php with action=lws_cl_delete_file and file_path containing ../
• Log Entries: PHP error logs showing unlink(../../wp-config.php): Operation not permitted or similar.
• System Changes: Sudden absence of wp-config.php or other critical files.

Detection Engineering

YARA Rule

rule CVE_2025_8575_LWS_Cleaner_File_Deletion {
    meta:
        description = "Detects attempts to exploit CVE-2025-8575 via path traversal in LWS Cleaner"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-8575"
    strings:
        $traversal = /\.\.\/[a-zA-Z0-9_\-\.]+/
        $function = "lws_cl_delete_file"
    condition:
        $function and $traversal
}

Sigma Rule

title: CVE-2025-8575 LWS Cleaner Arbitrary File Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests exploiting path traversal in LWS Cleaner plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: 'action=lws_cl_delete_file'
        cs-uri-query|contains: '../'
    condition: selection
falsepositives:
    - Legitimate admin actions if plugin uses relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-8575 LWS Cleaner Path Traversal"; flow:to_server,established; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=lws_cl_delete_file"; http_client_body; content:"../"; http_client_body; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the LWS Cleaner plugin until a patch is available.
2. Restrict admin access to only trusted users and enforce strong passwords.
3. Implement a Web Application Firewall (WAF) rule to block requests containing ../ in the file_path parameter.

Long-Term Fix:

• The vendor must release a patched version that validates file paths using realpath() and restricts deletion to a specific directory.
• Apply the principle of least privilege: the plugin should only be able to delete files within its own cache directory.

Workaround:

• If the plugin is essential, manually patch the vulnerable function by adding path validation as shown in the "Vulnerable vs. Patched Code" section.

Monitoring:

• Enable file integrity monitoring for critical WordPress files.
• Review admin activity logs regularly for suspicious file operations.

Valters IT
Securing Digital Frontiers