CVE-2025-12497: Phlox WordPress Plugin RCE Vulnerability

CVE-2025-12497 Overview

The Premium Portfolio Features for Phlox theme plugin for WordPress contains a Local File Inclusion (LFI) vulnerability in all versions up to and including 2.3.10. The vulnerability exists in the args[extra_template_path] parameter, which fails to properly sanitize user-supplied input. This allows unauthenticated attackers to include and execute arbitrary .php files on the server, enabling the execution of any PHP code contained within those files.

Critical Impact

Unauthenticated attackers can achieve remote code execution by including and executing arbitrary PHP files on the server, potentially leading to complete site compromise, data theft, and unauthorized access.

Affected Products

• Premium Portfolio Features for Phlox theme plugin for WordPress versions up to and including 2.3.10
• WordPress installations running vulnerable versions of the auxin-portfolio plugin

Discovery Timeline

• 2025-11-05 - CVE-2025-12497 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-12497

Vulnerability Analysis

This Local File Inclusion vulnerability (CWE-98) allows unauthenticated remote attackers to manipulate the args[extra_template_path] parameter to include arbitrary PHP files from the server's filesystem. The vulnerability stems from insufficient input validation on the template path parameter, which should be restricted to a whitelist of legitimate template files but instead accepts arbitrary paths.

Successful exploitation enables attackers to execute PHP code from any accessible .php file on the server. This can be leveraged for multiple attack scenarios including bypassing access controls, extracting sensitive configuration data such as database credentials from wp-config.php, and achieving full code execution when combined with the ability to upload PHP files through other means.

The attack complexity is considered high as exploitation may require specific conditions such as the presence of uploadable PHP files or knowledge of existing PHP file locations on the target system.

Root Cause

The root cause of this vulnerability is improper input validation on the args[extra_template_path] parameter. The plugin fails to implement proper sanitization or whitelisting of allowed template paths, allowing attackers to traverse the filesystem and include arbitrary PHP files. This represents a classic failure to apply the principle of least privilege and proper input validation on user-controllable parameters.

Attack Vector

The vulnerability is exploited via network-based requests targeting the vulnerable parameter. An attacker can craft malicious HTTP requests containing path traversal sequences or absolute paths in the args[extra_template_path] parameter to include sensitive PHP files.

The attack workflow involves sending a crafted request to the WordPress site with a malicious args[extra_template_path] value. The plugin processes this parameter without adequate validation, leading to the inclusion and execution of the attacker-specified PHP file. This could be exploited to include configuration files, uploaded malicious scripts, or other PHP files present on the system.

For technical details on this vulnerability, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-12497

Indicators of Compromise

• Unusual HTTP requests containing path traversal sequences (e.g., ../) targeting the args[extra_template_path] parameter
• Web server logs showing requests with suspicious file paths being passed to auxin-portfolio plugin endpoints
• Unexpected PHP file access or execution patterns in server logs
• Signs of unauthorized access to sensitive configuration files like wp-config.php

Detection Strategies

• Monitor web application firewall (WAF) logs for path traversal attempts targeting WordPress plugin endpoints
• Implement file integrity monitoring on critical WordPress files to detect unauthorized modifications
• Review access logs for requests containing the args[extra_template_path] parameter with suspicious values
• Deploy SentinelOne Singularity to detect and block malicious PHP file inclusion attempts in real-time

Monitoring Recommendations

• Enable verbose logging for WordPress and the auxin-portfolio plugin to capture request parameters
• Configure alerting for any requests containing path traversal patterns targeting plugin endpoints
• Monitor for unusual process spawning or file system access originating from PHP processes
• Implement network-level monitoring for data exfiltration attempts following potential exploitation

How to Mitigate CVE-2025-12497

Immediate Actions Required

• Update the Premium Portfolio Features for Phlox theme plugin to the latest patched version immediately
• Audit WordPress installations to identify any sites running vulnerable versions (2.3.10 or earlier)
• Review server logs for evidence of exploitation attempts targeting the args[extra_template_path] parameter
• Implement a Web Application Firewall (WAF) rule to block requests containing path traversal sequences

Patch Information

A security patch has been released for this vulnerability. The fix can be reviewed in the WordPress Plugin Changeset. Site administrators should update to the latest version of the Premium Portfolio Features for Phlox theme plugin through the WordPress admin dashboard or by manually downloading and installing the updated plugin files.

Workarounds

• If immediate patching is not possible, consider temporarily disabling the Premium Portfolio Features for Phlox theme plugin until the update can be applied
• Implement server-level restrictions using .htaccess or web server configuration to block requests containing suspicious path traversal patterns
• Use a Web Application Firewall with rules specifically blocking LFI attack patterns
• Restrict PHP's open_basedir directive to limit file access to the WordPress installation directory only

# Example .htaccess rule to block path traversal attempts
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./) [NC,OR]
    RewriteCond %{QUERY_STRING} (extra_template_path=) [NC]
    RewriteRule .* - [F,L]
</IfModule>