CVE-2025-24552: Paytium Information Disclosure Flaw

CVE-2025-24552 Overview

CVE-2025-24552 is an information disclosure vulnerability in the Paytium WordPress plugin developed by paytiumsupport. The flaw affects all versions up to and including 4.4.11. The plugin generates verbose error messages that reveal the full server file system path, a class of weakness known as Full Path Disclosure (FPD). The issue is tracked under CWE-209: Generation of Error Message Containing Sensitive Information. An unauthenticated remote attacker can trigger these errors to retrieve embedded sensitive data about the hosting environment. While the disclosed information does not directly grant code execution, it aids reconnaissance for follow-on attacks.

Critical Impact
Unauthenticated attackers can retrieve absolute server file paths and embedded environment data, providing reconnaissance for targeted exploitation of the underlying WordPress host.

Affected Products

Paytium WordPress Plugin versions through 4.4.11
WordPress installations using the paytiumsupport Paytium plugin
Sites processing Mollie payments via the vulnerable plugin

Discovery Timeline

2025-01-24 - CVE-2025-24552 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24552

Vulnerability Analysis

The vulnerability stems from improper error handling within the Paytium plugin. When specific endpoints or plugin scripts encounter unexpected input or missing parameters, PHP returns unhandled warnings and errors. These errors include the absolute file system path of the executing script, such as /var/www/html/wp-content/plugins/paytium/.... The plugin does not suppress or sanitize these responses before returning them to the client.

Exploitation requires no authentication and no user interaction. An attacker sends a crafted HTTP request to a plugin script that fails validation. The server responds with a verbose PHP error containing the disclosed path. The confidentiality impact is limited to information leakage; integrity and availability are unaffected.

Attackers use the disclosed paths to fingerprint the hosting environment, identify the operating system, and locate additional plugins or configuration files. This intelligence supports subsequent attacks such as local file inclusion, targeted brute force, or exploitation of adjacent WordPress vulnerabilities.

Root Cause

The root cause is the failure to disable PHP error display or catch exceptions at the plugin boundary. The plugin relies on the underlying PHP configuration to hide errors, which is not guaranteed on all WordPress hosts. When display_errors is enabled, uncaught warnings expose internal implementation details.

Attack Vector

The attack vector is network-based over HTTP or HTTPS. An attacker requests plugin resources directly with malformed or missing parameters. See the Patchstack Vulnerability Report for technical details on the triggering requests.

Detection Methods for CVE-2025-24552

Indicators of Compromise

HTTP requests targeting Paytium plugin scripts under /wp-content/plugins/paytium/ with missing or malformed parameters
HTTP response bodies containing absolute server paths such as /var/www/, /home/, or C:\inetpub\
Repeated 200 or 500 responses from Paytium endpoints originating from a single IP within a short window
Web server logs showing scanner user agents probing plugin directories

Detection Strategies

Inspect outbound HTTP responses for PHP warning strings such as Warning:, Fatal error:, or Stack trace: originating from plugin paths
Correlate WordPress access logs with response sizes that deviate from normal plugin behavior
Alert on anonymous requests to Paytium admin-ajax handlers that return non-standard error content

Monitoring Recommendations

Enable web application firewall logging for all /wp-content/plugins/paytium/ requests
Forward WordPress and PHP-FPM error logs to a centralized SIEM for correlation
Baseline normal Paytium plugin traffic and alert on error-rate anomalies

How to Mitigate CVE-2025-24552

Immediate Actions Required

Update the Paytium plugin to a version newer than 4.4.11 once the vendor publishes a fix
Disable the plugin if it is not actively required for payment processing
Set display_errors = Off and display_startup_errors = Off in the site's php.ini
Ensure WP_DEBUG and WP_DEBUG_DISPLAY are set to false in wp-config.php

Patch Information

At the time of publication, the Patchstack advisory tracks the vulnerability against versions up to 4.4.11. Administrators should monitor the WordPress plugin repository for a patched release and apply it immediately when available.

Workarounds

Configure the web server or WAF to strip PHP error strings from outbound responses
Deploy virtual patching rules that block requests producing full-path disclosure responses from Paytium endpoints
Restrict direct access to plugin PHP files via .htaccess or Nginx location rules

bash

# Configuration example: suppress PHP error disclosure in wp-config.php
define( 'WP_DEBUG', false );
define( 'WP_DEBUG_DISPLAY', false );
@ini_set( 'display_errors', 0 );