CVE-2025-23949 Overview
CVE-2025-23949 is a PHP Local File Inclusion (LFI) vulnerability affecting the dzeriho Improved Sale Badges – Free Version WordPress plugin. The flaw exists in versions up to and including 1.0.1 and stems from improper control of filename input passed to PHP include/require statements [CWE-98]. An unauthenticated attacker can manipulate file path parameters to force the plugin to include arbitrary local PHP files on the server. Successful exploitation can lead to source code disclosure, sensitive configuration exposure, and arbitrary code execution when an attacker can place or influence content in an includable file.
Critical Impact
Unauthenticated network-based exploitation can result in arbitrary PHP code execution on the WordPress host, leading to full site compromise.
Affected Products
- dzeriho Improved Sale Badges – Free Version plugin for WordPress
- All versions from initial release through 1.0.1
- WordPress sites with the improved-sale-badges-free-version plugin installed and active
Discovery Timeline
- 2025-01-22 - CVE-2025-23949 published to the National Vulnerability Database
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-23949
Vulnerability Analysis
The vulnerability is classified under [CWE-98]: Improper Control of Filename for Include/Require Statement in PHP Program. The plugin accepts attacker-controlled input and passes it into a PHP include or require construct without sufficient validation or sanitization. While the advisory describes the issue as PHP Remote File Inclusion in the title, the confirmed exploitation path is Local File Inclusion against files reachable on the WordPress server.
Attack complexity is rated High because the attacker must locate a usable target file, but no authentication or user interaction is required. Confidentiality, integrity, and availability are all impacted. An EPSS score of 1.606% places this issue in the 81st percentile relative to all CVEs, indicating measurable exploitation likelihood compared to typical plugin flaws.
Root Cause
The root cause is the use of unsanitized request data as part of a dynamic file path argument to a PHP file inclusion function. The plugin does not constrain the input to an allowlist, does not strip directory traversal sequences such as ../, and does not enforce an extension or base directory check before invoking include. As a result, any file path resolvable by the PHP process can be loaded and executed within the WordPress request context.
Attack Vector
Exploitation occurs over the network against the WordPress HTTP interface. An unauthenticated attacker submits a crafted request containing a manipulated file path parameter handled by the vulnerable plugin endpoint. The plugin resolves this path and includes the target file. If the included file contains PHP, it is executed with the privileges of the web server user. Attackers commonly chain LFI with log poisoning, session file injection, or upload primitives to escalate from local inclusion to arbitrary code execution. No verified public proof-of-concept exploit code is available in the referenced sources.
Detection Methods for CVE-2025-23949
Indicators of Compromise
- HTTP requests to the WordPress site containing directory traversal sequences (../, encoded variants such as %2e%2e%2f) in query string or POST parameters targeting plugin endpoints under /wp-content/plugins/improved-sale-badges-free-version/.
- Requests that reference sensitive local files such as /etc/passwd, wp-config.php, or PHP session and log files in plugin parameters.
- Unexpected PHP errors in web server logs indicating failed include/require calls originating from the plugin directory.
Detection Strategies
- Inspect web access logs for anomalous parameter values pointing the plugin to filesystem paths or PHP wrappers like php://filter.
- Deploy web application firewall rules that flag traversal patterns and include-style parameter abuse against the plugin URL path.
- Correlate web request anomalies with PHP runtime errors and new PHP process activity on the host to surface successful exploitation.
Monitoring Recommendations
- Monitor the wp-content/plugins/improved-sale-badges-free-version/ directory for new or modified files indicating post-exploitation persistence.
- Alert on web server processes spawning shells, wget, curl, or unexpected outbound network connections following requests to the plugin.
- Track changes to wp-config.php and other sensitive WordPress files for unauthorized reads or modifications.
How to Mitigate CVE-2025-23949
Immediate Actions Required
- Deactivate and remove the Improved Sale Badges – Free Version plugin until a patched release is confirmed installed.
- Audit WordPress logs for requests targeting the plugin and any indicators of successful file inclusion.
- Rotate WordPress secrets, database credentials, and any keys stored in wp-config.php if exploitation is suspected.
Patch Information
No fixed version has been published for the Improved Sale Badges – Free Version plugin at the time of this CVE record. The advisory confirms all versions through 1.0.1 are affected. Site operators should consult the Patchstack Vulnerability Database Entry for the latest remediation status and consider permanent removal if no update becomes available.
Workarounds
- Remove the plugin entirely and replace it with a maintained alternative.
- Apply a WAF rule blocking directory traversal sequences and PHP stream wrappers in requests targeting /wp-content/plugins/improved-sale-badges-free-version/.
- Restrict PHP open_basedir and disable dangerous functions to limit the impact of file inclusion across all installed plugins.
# Example: disable and remove the vulnerable plugin via WP-CLI
wp plugin deactivate improved-sale-badges-free-version
wp plugin delete improved-sale-badges-free-version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
