CVE-2025-22279 Overview
CVE-2025-22279 is a PHP Local File Inclusion (LFI) vulnerability in the Crocoblock JetCompareWishlist WordPress plugin. The flaw stems from improper control of filename parameters used in PHP include or require statements, classified under [CWE-98]. Authenticated attackers can manipulate file path parameters to include arbitrary local files on the server, leading to information disclosure or code execution under specific conditions. The vulnerability affects all versions of jet-compare-wishlist up to and including 1.5.9. According to the EPSS model, the probability of exploitation within 30 days is 0.43% (62.9th percentile).
Critical Impact
Authenticated attackers can read sensitive server-side files and potentially execute arbitrary PHP code through log poisoning or uploaded file inclusion.
Affected Products
- Crocoblock JetCompareWishlist plugin for WordPress
- All versions from initial release through 1.5.9
- WordPress sites with the jet-compare-wishlist plugin installed and activated
Discovery Timeline
- 2025-04-10 - CVE-2025-22279 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-22279
Vulnerability Analysis
The vulnerability resides in the JetCompareWishlist plugin's handling of file inclusion operations. The plugin accepts user-controllable input that is passed directly to a PHP include or require statement without adequate validation or sanitization. This pattern allows attackers to traverse the file system and load arbitrary files interpreted as PHP code.
Local File Inclusion in WordPress plugins commonly enables disclosure of wp-config.php, which contains database credentials and authentication keys. Attackers can also include log files, uploaded images with embedded PHP, or session files to achieve remote code execution. The CWE-98 classification identifies this as improper neutralization of a filename parameter passed to a dynamic file inclusion function.
Root Cause
The root cause is the absence of a strict allowlist for files that can be loaded through the plugin's request handlers. User-supplied parameters reach a PHP file inclusion function without normalization or boundary checks, permitting directory traversal sequences such as ../ to escape the intended directory.
Attack Vector
Exploitation requires network access and low-privilege authentication on the target WordPress instance. An attacker sends a crafted HTTP request to a plugin endpoint with a manipulated filename parameter pointing to a target file on the server. The high attack complexity reflects that successful exploitation often depends on knowing valid file paths or chaining the inclusion with a writable file location. Refer to the Patchstack WordPress Vulnerability Report for technical details.
Detection Methods for CVE-2025-22279
Indicators of Compromise
- HTTP requests to JetCompareWishlist plugin endpoints containing directory traversal sequences such as ../ or URL-encoded variants %2e%2e%2f
- Web server access logs showing parameter values referencing sensitive files like wp-config.php, /etc/passwd, or PHP session files
- Unexpected PHP errors in server logs referencing include() or require() calls originating from jet-compare-wishlist plugin files
Detection Strategies
- Inspect WordPress access logs for requests targeting jet-compare-wishlist paths with suspicious query parameters
- Deploy a web application firewall rule that blocks path traversal patterns in parameters passed to plugin endpoints
- Audit file integrity on the WordPress installation to detect unauthorized PHP files in upload directories
Monitoring Recommendations
- Enable verbose PHP error logging and alert on include/require warnings referencing user-controlled paths
- Monitor authenticated user sessions for anomalous request patterns against JetCompareWishlist endpoints
- Forward WordPress and web server logs to a centralized log analytics platform for correlation across requests and authentication events
How to Mitigate CVE-2025-22279
Immediate Actions Required
- Identify all WordPress instances with the jet-compare-wishlist plugin installed and confirm the installed version
- Disable or remove the JetCompareWishlist plugin if a patched version is not yet available for installation
- Rotate WordPress secret keys and database credentials if log analysis indicates successful exploitation attempts
Patch Information
The Patchstack advisory tracks CVE-2025-22279 as affecting JetCompareWishlist versions up to and including 1.5.9. Site administrators should monitor the Crocoblock vendor channel and the WordPress plugin repository for a patched release and apply it immediately upon availability. Consult the Patchstack advisory for the current fixed version reference.
Workarounds
- Restrict authenticated access to the WordPress instance and reduce the number of low-privilege accounts that can reach plugin endpoints
- Configure web application firewall rules to block path traversal sequences and reject parameters referencing PHP system paths
- Apply file system permissions that prevent the PHP process from reading sensitive configuration files outside the web root where feasible
# Configuration example
# Example WAF rule blocking path traversal on plugin endpoints
SecRule REQUEST_URI "@contains /wp-content/plugins/jet-compare-wishlist/" \
"chain,deny,status:403,id:1002201,msg:'CVE-2025-22279 LFI attempt'"
SecRule ARGS "@rx (\.\./|%2e%2e%2f|wp-config\.php|/etc/passwd)" "t:lowercase,t:urlDecode"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
