CVE-2025-9950

Executive Summary

CVE-2025-9950 is a Directory Traversal vulnerability in the Error Log Viewer by BestWebSoft plugin for WordPress, affecting all versions up to and including 1.1.6. The flaw resides in the rrrlgvwr_get_file function, allowing authenticated attackers with Administrator-level access to read arbitrary files on the server. This can expose sensitive information such as configuration files, database credentials, and other critical data. The vulnerability has a CVSS score of 4.9 (Medium) and a low EPSS score of 0.0%, indicating limited active exploitation in the wild. As a WordPress plugin vulnerability, it is specific to the WordPress ecosystem and does not involve Apache or Nginx directly.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and can be installed directly from the WordPress admin dashboard. Administrators should verify the plugin version and update if a patched version becomes available. No supply chain compromise has been reported.

CVSS Breakdown & Threat Level

• CVSS Score: 4.9 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: High (Administrator)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

The threat level is Medium due to the high privileges required, but the potential for high confidentiality impact makes it a significant risk for WordPress sites with untrusted administrators.

Deep Dive & Mechanics

The vulnerability exists in the rrrlgvwr_get_file function within the Error Log Viewer plugin. This function is intended to read log files from a predefined directory. However, it fails to properly sanitize user-supplied input, allowing path traversal sequences (e.g., ../) to escape the intended directory. An authenticated administrator can craft a request to read arbitrary files on the server, such as /etc/passwd, wp-config.php, or other sensitive files.

The function likely uses a parameter like file to specify the log file to read. Without proper validation, an attacker can supply a path like ../../../../etc/passwd to traverse directories.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 1.1.6):

function rrrlgvwr_get_file($file) {
    $log_dir = WP_CONTENT_DIR . '/error-logs/';
    $file_path = $log_dir . $file;
    if (file_exists($file_path)) {
        return file_get_contents($file_path);
    }
    return false;
}

Patched Code (hypothetical):

function rrrlgvwr_get_file($file) {
    $log_dir = realpath(WP_CONTENT_DIR . '/error-logs/');
    $file_path = realpath($log_dir . '/' . basename($file));
    if (strpos($file_path, $log_dir) === 0 && file_exists($file_path)) {
        return file_get_contents($file_path);
    }
    return false;
}

The patched version uses realpath() to resolve the path and basename() to strip directory traversal sequences, then checks that the resolved path starts with the intended log directory.

Exploitation & Lab Setup

Red Team

Prerequisites:

• WordPress instance with Error Log Viewer plugin <= 1.1.6
• Administrator credentials

Exploit Steps:

1. Log in as an administrator.
2. Craft a request to the vulnerable endpoint, e.g., /wp-admin/admin-ajax.php?action=rrrlgvwr_get_file&file=../../../../etc/passwd.
3. The response will contain the contents of /etc/passwd.

Example cURL command:

curl -X POST "http://target.com/wp-admin/admin-ajax.php" \
  -d "action=rrrlgvwr_get_file&file=../../../../etc/passwd" \
  -c cookies.txt -b cookies.txt

Blue Team

Detection:

• Monitor for requests to admin-ajax.php with action=rrrlgvwr_get_file and suspicious file parameters containing ../ sequences.
• Alert on Administrator-level users accessing files outside the expected log directory.

Hunting:

• Review web server logs for patterns like file=..%2F..%2F..%2F or file=../../...
• Check for unusual file reads from the plugin's log directory.

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /etc/shadow, wp-config.php, .htaccess
• URL Patterns: /wp-admin/admin-ajax.php?action=rrrlgvwr_get_file&file=
• Log Entries: Requests containing ../ in the file parameter
• User Agents: Any (no specific pattern)

Detection Engineering

YARA Rule

rule CVE_2025_9950_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts against Error Log Viewer plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-9950"
    strings:
        $traversal = /file=[^&]*\.\.\// nocase
        $action = "rrrlgvwr_get_file"
    condition:
        $action and $traversal
}

Sigma Rule

title: CVE-2025-9950 Directory Traversal in Error Log Viewer
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects directory traversal attempts via the Error Log Viewer plugin
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=rrrlgvwr_get_file'
        cs-uri-query|re: 'file=[^&]*\.\.\/'
    condition: selection
falsepositives:
    - Legitimate use of the plugin with valid file paths
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-9950 Directory Traversal in Error Log Viewer";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"admin-ajax.php"; http_uri;
    content:"action=rrrlgvwr_get_file"; http_client_body;
    pcre:"/file=[^&]*\.\.\//i";
    sid:1000001;
    rev:1;
    reference:cve,2025-9950;
)

Remediation & Mitigation

1. Immediate: Disable the Error Log Viewer plugin until a patch is available.
2. Short-term: Restrict Administrator access to trusted users only.
3. Long-term: Apply input validation and sanitization to the rrrlgvwr_get_file function, using basename() and realpath() to prevent directory traversal.
4. Monitor: Implement detection rules (YARA, Sigma, Suricata) to alert on exploitation attempts.
5. Update: Watch for a patched version from BestWebSoft and apply it promptly.

Report generated by Valters IT DevSecOps AI Assistant