CVE-2025-23938 Overview
CVE-2025-23938 is a PHP Local File Inclusion (LFI) vulnerability in the CRUDLab Image Gallery Box plugin for WordPress. The flaw stems from improper control of filename parameters used in PHP include/require statements [CWE-98]. It affects all versions of the image-gallery-box-by-crudlab plugin from initial release through 1.0.3. Authenticated attackers with low privileges can abuse the unsanitized file path input to load arbitrary PHP files from the server. Successful exploitation results in disclosure of sensitive data, code execution within the WordPress context, and full compromise of the underlying site.
Critical Impact
Authenticated attackers can load arbitrary PHP files from the WordPress host, leading to remote code execution and full site compromise.
Affected Products
- CRUDLab Image Gallery Box plugin for WordPress (image-gallery-box-by-crudlab)
- All versions from initial release through 1.0.3
- WordPress installations with the affected plugin enabled
Discovery Timeline
- 2025-01-22 - CVE-2025-23938 published to the National Vulnerability Database
- 2026-06-17 - CVE-2025-23938 last updated in NVD
Technical Details for CVE-2025-23938
Vulnerability Analysis
The vulnerability is classified under [CWE-98]: Improper Control of Filename for Include/Require Statement in PHP Program. The plugin passes user-controllable input into a PHP include or require call without proper validation or path normalization. Attackers supplying crafted path values can traverse the file system and force the plugin to execute PHP code from arbitrary local files.
The vulnerability requires low-privilege authentication, which limits opportunistic mass exploitation but remains accessible to contributors, subscribers, or compromised low-tier accounts on multi-user WordPress sites. Once a malicious file is included, the attacker gains code execution under the web server process, enabling lateral movement, credential theft, and persistence within the WordPress environment.
Root Cause
The plugin accepts a filename or path parameter from a request and concatenates it into a PHP file inclusion statement without enforcing an allowlist or sanitizing directory traversal sequences. Any local PHP file readable by the web server can be executed through the inclusion sink.
Attack Vector
The attack is delivered over the network through a crafted HTTP request to the vulnerable plugin endpoint. The attacker authenticates with a low-privilege WordPress account and submits a manipulated path parameter. The plugin resolves the path and executes the targeted PHP file. Refer to the Patchstack Vulnerability Report for additional technical details.
Detection Methods for CVE-2025-23938
Indicators of Compromise
- HTTP requests to Image Gallery Box plugin endpoints containing path traversal sequences such as ../ or absolute file paths
- Unexpected access to sensitive PHP files such as wp-config.php or files outside the plugin directory
- Web server processes spawning child processes or outbound connections shortly after plugin requests
- Creation of new PHP files in wp-content/uploads/ or other writable directories following plugin activity
Detection Strategies
- Inspect WordPress access logs for requests targeting image-gallery-box-by-crudlab plugin handlers with suspicious file path parameters
- Deploy web application firewall rules that block path traversal patterns and absolute paths in plugin parameters
- Monitor PHP error logs for include/require warnings referencing unexpected file paths
Monitoring Recommendations
- Alert on file integrity changes within WordPress core, plugin, and theme directories
- Track authenticated low-privilege user sessions that issue requests to administrative or plugin AJAX endpoints
- Capture outbound network connections from PHP-FPM or Apache worker processes for anomaly review
How to Mitigate CVE-2025-23938
Immediate Actions Required
- Disable or deactivate the CRUDLab Image Gallery Box plugin until a patched release is verified and installed
- Audit WordPress user accounts and revoke unnecessary low-privilege access that could be leveraged for exploitation
- Review web server and PHP logs for evidence of file inclusion attempts since the plugin was first installed
- Rotate WordPress secrets, database credentials, and API keys if exploitation is suspected
Patch Information
The Patchstack advisory lists all versions up to and including 1.0.3 as vulnerable. Administrators should monitor the Patchstack Vulnerability Report and the plugin's WordPress.org page for the availability of a fixed release, then upgrade immediately once published.
Workarounds
- Remove the image-gallery-box-by-crudlab directory from wp-content/plugins/ if the plugin is not business critical
- Add web application firewall rules that block requests containing ../, null bytes, or absolute paths in plugin parameters
- Restrict PHP open_basedir to the WordPress installation directory to limit which files can be included
- Enforce least privilege on WordPress roles and disable self-registration where it is not required
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
