CVE-2025-23945: Popliup Path Traversal Vulnerability

CVE-2025-23945 Overview

CVE-2025-23945 is a Local File Inclusion (LFI) vulnerability in the Webliup Popliup WordPress plugin. The flaw affects all versions up to and including 1.1.1. It originates from improper control of filenames passed to PHP include or require statements, classified as [CWE-98].

An authenticated attacker with low privileges can supply manipulated input that causes the plugin to include arbitrary local files on the server. Successful exploitation can disclose sensitive configuration data, expose credentials, or lead to code execution if attacker-controlled files exist on the host.

Critical Impact
Authenticated attackers can read or execute arbitrary local files through the Popliup plugin, threatening confidentiality, integrity, and availability of the WordPress site.

Affected Products

Webliup Popliup WordPress plugin versions <= 1.1.1
WordPress installations with the Popliup plugin enabled
Hosting environments running vulnerable Popliup plugin instances

Discovery Timeline

2025-03-03 - CVE-2025-23945 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-23945

Vulnerability Analysis

The vulnerability sits in how the Popliup plugin constructs file paths used by PHP include or require statements. User-supplied input reaches the inclusion function without sufficient validation or path normalization. This allows traversal sequences and absolute paths to resolve outside the intended directory.

The attack can be executed over the network, requires low-level authenticated access, and needs no user interaction. Exploitation complexity is rated high, indicating that specific preconditions or non-trivial steps are required to trigger the inclusion successfully.

The Exploit Prediction Scoring System (EPSS) places this issue around the 55th percentile, reflecting moderate observed interest relative to other published CVEs.

Root Cause

The root cause is improper neutralization of filename input used in PHP file inclusion functions. The plugin does not enforce a strict allowlist of permitted files. It also fails to canonicalize the resolved path before passing it to include or require, leaving traversal characters effective.

Attack Vector

An authenticated attacker submits a crafted request to a vulnerable Popliup endpoint. The request contains a parameter that controls the file path used in a PHP inclusion call. By supplying traversal sequences such as ../ or absolute paths, the attacker forces the application to include sensitive files like wp-config.php, logs, or session files. If the attacker can place PHP content into a readable location on disk, the inclusion can escalate into arbitrary code execution. Refer to the Patchstack Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-23945

Indicators of Compromise

HTTP requests to Popliup plugin endpoints containing path traversal sequences such as ../, ..\, or URL-encoded equivalents %2e%2e%2f
Web server access logs showing parameters referencing sensitive files like wp-config.php, /etc/passwd, or PHP session files
Unexpected PHP error entries referencing failed include or require calls originating from the Popliup plugin directory

Detection Strategies

Inspect WordPress request logs for parameters consumed by the Popliup plugin that contain filesystem path characters
Apply web application firewall rules that block traversal patterns and absolute path inputs to plugin endpoints
Correlate authenticated WordPress sessions with anomalous plugin parameter values to identify abuse by low-privileged accounts

Monitoring Recommendations

Enable PHP error logging and alert on include/require failures referencing plugin files
Monitor file system access patterns for reads of sensitive WordPress configuration files by the web server user
Track outbound network connections from the WordPress host that follow suspicious inclusion attempts

How to Mitigate CVE-2025-23945

Immediate Actions Required

Disable or remove the Popliup plugin until a patched release is installed
Restrict WordPress user accounts with plugin access to trusted administrators only
Audit recent web server logs for evidence of LFI exploitation attempts targeting Popliup endpoints

Patch Information

At the time of publication, the vendor advisory indexed by Patchstack lists Popliup versions through 1.1.1 as affected. Administrators should consult the Patchstack Vulnerability Report for the latest fixed version and upgrade guidance.

Workarounds

Deploy a web application firewall rule that blocks traversal sequences and absolute paths in plugin parameters
Set the PHP open_basedir directive to confine file inclusion to the WordPress installation directory
Remove or restrict access to the Popliup plugin directory via web server configuration until patched

bash

# Configuration example: restrict PHP file inclusion scope via php.ini
open_basedir = "/var/www/html/wordpress/:/tmp/"
disable_functions = ""
allow_url_include = Off
allow_url_fopen = Off