CVE-2025-13088: WordPress Plugin Path Traversal Flaw

CVE-2025-13088 Overview

CVE-2025-13088 is a Local File Inclusion (LFI) vulnerability in the Category and Product WooCommerce Tabs plugin for WordPress, affecting all versions through 1.0. The flaw resides in the categoryProductTab() function, which fails to validate the template parameter before passing it to a PHP file inclusion call. Authenticated attackers with Contributor-level access or higher can include and execute arbitrary .php files on the server. The vulnerability is tracked under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.

Critical Impact
Authenticated attackers with Contributor privileges can execute arbitrary PHP files on the host, leading to full site compromise and potential remote code execution.

Affected Products

Category and Product WooCommerce Tabs plugin for WordPress
All versions up to and including 1.0
WordPress sites running WooCommerce with this plugin installed

Discovery Timeline

2025-11-18 - CVE-2025-13088 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13088

Vulnerability Analysis

The vulnerability stems from insufficient input validation on the template parameter inside the categoryProductTab() function in include/wccategorytab.php. The plugin uses user-controlled input to construct a file path that is then passed to a PHP include or require statement. Because the parameter is not sanitized against directory traversal sequences or restricted to an allowlist of templates, attackers can reference arbitrary files on the filesystem.

Any PHP file accessible to the web server process can be included and executed in the context of the WordPress application. This includes attacker-staged files uploaded through other plugin functionality, log files containing injected PHP payloads, or sensitive configuration files. The classification [CWE-98] applies because the include path is derived from untrusted input.

Root Cause

The categoryProductTab() handler accepts the template parameter from the request and concatenates it into a file path used by PHP's file inclusion functions. There is no realpath() validation, no allowlist comparison, and no stripping of ../ traversal sequences. The function trusts the parameter completely.

Attack Vector

Exploitation requires an authenticated WordPress account with Contributor role or higher. The attacker submits a crafted request to the plugin endpoint with a manipulated template parameter pointing to a target .php file. The PHP interpreter then executes the referenced file under the web server's privileges.

This attack chain is commonly paired with secondary primitives such as image upload abuse, log poisoning, or session file injection to stage attacker-controlled PHP content that is then loaded through the LFI. See the WordPress Plugin Code Review and Wordfence Vulnerability Report for technical details.

Detection Methods for CVE-2025-13088

Indicators of Compromise

Web server requests containing the template parameter with directory traversal sequences such as ../ or absolute filesystem paths
Unexpected PHP execution originating from inclusion of files outside the plugin directory
New or modified PHP files in wp-content/uploads/ or other writable directories accessed shortly after suspicious plugin requests
WordPress audit logs showing Contributor-level accounts triggering the plugin's tab rendering endpoints

Detection Strategies

Inspect web access logs for requests to the plugin handler containing template= values that reference unexpected paths or file extensions
Monitor PHP error logs for include/require warnings referencing files outside the plugin directory
Apply WAF signatures that flag path traversal patterns in WordPress query parameters
Correlate Contributor account activity with file-inclusion warnings to identify low-privileged accounts attempting privilege escalation

Monitoring Recommendations

Enable file integrity monitoring on the WordPress installation, especially wp-content/uploads/ and the plugin directory
Alert on creation of .php files inside upload directories that should only contain media assets
Track authentication events for Contributor and Author accounts to detect credential abuse
Review installed plugins regularly for unpatched or abandoned components using the Wordfence intelligence feed

How to Mitigate CVE-2025-13088

Immediate Actions Required

Deactivate and remove the Category and Product WooCommerce Tabs plugin until a patched version is released by the vendor
Audit all WordPress user accounts with Contributor role or higher and revoke unused or stale accounts
Scan wp-content/uploads/ and other writable directories for unauthorized .php files
Rotate WordPress secret keys in wp-config.php and reset passwords for privileged accounts if exploitation is suspected

Patch Information

No vendor patch is referenced in the NVD entry as of the last modification date. The vulnerability affects all versions up to and including 1.0. Administrators should monitor the WordPress plugin repository and the Wordfence advisory for a fixed release and apply it as soon as it is available.

Workarounds

Remove the plugin entirely if a patched version is not available
Restrict Contributor and Author registration on production sites and require admin approval for new accounts
Configure a Web Application Firewall rule that blocks requests containing path traversal sequences in the template parameter
Set open_basedir in PHP configuration to restrict file inclusion to the WordPress document root and prevent access to sensitive system files

bash

# PHP open_basedir restriction example for php.ini or .user.ini
open_basedir = "/var/www/html/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"