CVE-2025-23915 Overview
CVE-2025-23915 is a Local File Inclusion (LFI) vulnerability affecting the FAT Event Lite WordPress plugin developed by roninwp. The flaw stems from improper control of filenames used in PHP include or require statements, classified under [CWE-98]. Authenticated attackers can leverage this weakness to include local files on the server through the vulnerable plugin. The vulnerability affects all versions of FAT Event Lite up to and including 1.1. Successful exploitation can lead to disclosure of sensitive files, execution of injected PHP content, and further compromise of the underlying WordPress installation.
Critical Impact
Authenticated attackers can include local server files through the FAT Event Lite plugin, exposing sensitive configuration data and enabling potential code execution.
Affected Products
- roninwp FAT Event Lite WordPress plugin
- All versions from n/a through 1.1
- WordPress sites running the fat-event-lite plugin
Discovery Timeline
- 2025-01-16 - CVE-2025-23915 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-23915
Vulnerability Analysis
The vulnerability resides in how the FAT Event Lite plugin handles filename input passed to PHP file inclusion functions. The plugin fails to properly sanitize or validate user-supplied input before passing it to include or require statements. This allows an authenticated attacker to influence the file path resolved by the PHP interpreter. Because the inclusion is limited to local files, the flaw is categorized as a non-arbitrary Local File Inclusion rather than remote file inclusion. Exploitation requires authenticated access, which raises the attack complexity but does not eliminate the risk in multi-user WordPress environments.
Root Cause
The root cause is improper control of filename input used in PHP include/require calls, tracked as [CWE-98]. The plugin trusts user-supplied parameters and concatenates them into a file path without enforcing an allowlist of permitted files or normalizing traversal sequences. This design permits attackers to point the include statement at unintended files residing on the local filesystem.
Attack Vector
An authenticated attacker sends a crafted HTTP request to a plugin endpoint that accepts a filename parameter. The plugin resolves the attacker-controlled value and passes it directly to a PHP file inclusion function. The interpreter then executes or reads the contents of the referenced file. Because the vulnerable endpoint is reachable over the network, exploitation can be performed remotely once valid credentials are obtained. Technical details are documented in the Patchstack Vulnerability Announcement.
No verified proof-of-concept code has been released. See the security advisory for further technical context.
Detection Methods for CVE-2025-23915
Indicators of Compromise
- Unexpected HTTP requests to FAT Event Lite plugin endpoints containing filename parameters with path traversal sequences such as ../ or absolute file paths
- Web server access logs showing authenticated requests referencing sensitive files like wp-config.php, /etc/passwd, or PHP session files
- Anomalous PHP error entries referencing include() or require() failures on unusual file paths
Detection Strategies
- Inspect WordPress and web server logs for requests targeting the fat-event-lite plugin directory paired with suspicious query parameters
- Deploy web application firewall (WAF) rules that flag path traversal patterns and known LFI payloads sent to plugin URLs
- Correlate authenticated user sessions with unusual file access patterns originating from plugin execution
Monitoring Recommendations
- Enable verbose PHP error logging to capture failed inclusion attempts referencing attacker-controlled paths
- Monitor filesystem read events on sensitive files such as wp-config.php, .htaccess, and credential stores
- Alert on newly created or modified PHP files within the WordPress uploads directory, which could indicate follow-on code execution
How to Mitigate CVE-2025-23915
Immediate Actions Required
- Deactivate and remove the FAT Event Lite plugin from any WordPress site running version 1.1 or earlier until a fixed release is available
- Rotate all WordPress administrator, editor, and author credentials to reduce the risk of authenticated exploitation
- Audit installed plugins and remove any unused or unmaintained extensions that expand the attack surface
Patch Information
At the time of publication, no vendor-supplied patched version is listed in the enriched CVE data. Refer to the Patchstack Vulnerability Announcement for the latest remediation guidance and to confirm whether an updated release has been published by roninwp.
Workarounds
- Restrict access to the WordPress admin interface using IP allowlisting or a reverse proxy to limit which users can reach the vulnerable endpoint
- Configure the PHP open_basedir directive to constrain file inclusion to the WordPress installation directory
- Deploy WAF signatures that block path traversal sequences and known LFI payloads targeting WordPress plugin routes
# Example php.ini restriction to limit file inclusion scope
open_basedir = "/var/www/html/wordpress/:/tmp/"
disable_functions = "show_source,system,shell_exec,passthru,exec,phpinfo,popen,proc_open"
allow_url_include = Off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
