CVE-2025-24733: Post Grid Master Path Traversal Flaw

CVE-2025-24733 Overview

CVE-2025-24733 is a Local File Inclusion (LFI) vulnerability in the Post Grid Master WordPress plugin developed by Akhtarujjaman Shuvo (Addonmaster). The flaw resides in the ajax-filter-posts component and stems from improper control of filenames used in PHP include or require statements. Authenticated attackers with low privileges can abuse this weakness to include arbitrary local PHP files on the server. All versions of Post Grid Master up to and including 3.4.12 are affected. The issue is tracked under [CWE-98] and [CWE-706].

Critical Impact
An authenticated attacker can read sensitive server-side files and potentially execute PHP code by including attacker-controlled or log-poisoned files through the vulnerable AJAX endpoint.

Affected Products

Addonmaster Post Grid Master for WordPress (plugin slug: ajax-filter-posts)
All versions from initial release through 3.4.12
WordPress sites using the vulnerable plugin with any authenticated user role

Discovery Timeline

2025-01-24 - CVE-2025-24733 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24733

Vulnerability Analysis

The Post Grid Master plugin exposes AJAX handlers under the ajax-filter-posts component that construct filesystem paths from user-supplied input. The plugin passes these paths to PHP inclusion functions without validating that the resolved file remains within an allowed directory. An authenticated attacker submits a crafted parameter to the AJAX endpoint and forces the plugin to include an arbitrary local PHP file. The attack requires network access to the WordPress site and low-privilege authentication, with no user interaction. Successful exploitation results in disclosure of file contents such as wp-config.php, credentials, or private keys stored on the web server.

Root Cause

The root cause is improper neutralization of path traversal sequences and missing allowlist validation on the filename parameter consumed by the plugin's AJAX handler. PHP treats included files as executable code, so any file with PHP syntax is parsed and run within the WordPress process context. This weakness maps directly to [CWE-98] (PHP Remote File Inclusion) and [CWE-706] (Use of Incorrectly-Resolved Name or Reference).

Attack Vector

Exploitation occurs over the network against the WordPress admin-ajax.php endpoint. The attacker authenticates as a subscriber-level or higher user, then issues an AJAX request to the vulnerable ajax-filter-posts action with a manipulated path parameter. Traversal sequences such as ../../../../ allow escape from the intended template directory. Attackers commonly chain LFI with log poisoning or session file injection to achieve remote code execution when writable log files contain attacker-controlled PHP.

No public proof-of-concept code has been published. See the Patchstack Security Vulnerability Report for advisory details.

Detection Methods for CVE-2025-24733

Indicators of Compromise

Requests to /wp-admin/admin-ajax.php with the action parameter referencing ajax-filter-posts and path traversal sequences such as ../ or URL-encoded %2e%2e%2f
Web server access logs showing parameter values containing paths like wp-config.php, /etc/passwd, or /proc/self/environ
Unexpected PHP errors referencing include(), require(), or failed to open stream in web server error logs
Outbound network activity from the PHP-FPM or web server process to attacker-controlled hosts following suspicious AJAX requests

Detection Strategies

Deploy web application firewall rules that inspect admin-ajax.php requests for directory traversal patterns targeting the ajax-filter-posts action
Monitor WordPress plugin inventories for post-grid-master at version 3.4.12 or earlier across managed sites
Correlate authenticated user session activity with anomalous file access patterns on the web server host

Monitoring Recommendations

Enable verbose PHP error logging and forward logs to a centralized SIEM for pattern matching on inclusion failures
Alert on any read access to wp-config.php originating from the web server user outside of expected WordPress bootstrap operations
Track baseline volumes of admin-ajax.php requests per user account and flag deviations from authenticated subscriber accounts

How to Mitigate CVE-2025-24733

Immediate Actions Required

Identify all WordPress installations running Post Grid Master version 3.4.12 or earlier and prioritize remediation
Deactivate and remove the plugin if a patched version is not yet available for your deployment
Rotate any credentials, API keys, or secrets stored in wp-config.php if exploitation is suspected
Restrict WordPress user registration and audit existing low-privilege accounts for signs of abuse

Patch Information

At the time of NVD publication, the advisory lists affected versions through 3.4.12 with no fixed version specified. Consult the Patchstack Security Vulnerability Report and the plugin vendor's WordPress.org listing for the latest patched release before upgrading.

Workarounds

Block requests to admin-ajax.php where the action parameter matches ajax-filter-posts at the WAF or reverse proxy layer until a patch is applied
Apply open_basedir restrictions in PHP configuration to limit which directories the web server can read
Enforce least-privilege file permissions so that sensitive files such as wp-config.php are not world-readable by the web server user
Disable allow_url_include and allow_url_fopen in php.ini to reduce impact if the flaw is chained with remote inclusion techniques

bash

# Configuration example: harden php.ini against file inclusion abuse
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"