CVE-2025-24782: Post Grid Ultimate Path Traversal Flaw

CVE-2025-24782 Overview

CVE-2025-24782 is a Local File Inclusion (LFI) vulnerability in the wpWax Post Grid, Slider & Carousel Ultimate WordPress plugin. The flaw stems from improper control of filename arguments passed to PHP include/require statements [CWE-98]. Attackers with low-privilege authenticated access can supply crafted file paths that cause the plugin to load arbitrary local PHP files on the server. The vulnerability affects all versions of the plugin up to and including 1.6.10. Successful exploitation can lead to arbitrary PHP code execution, sensitive file disclosure, and full compromise of the WordPress installation.

Critical Impact
Authenticated attackers can include and execute arbitrary local PHP files, leading to remote code execution on the WordPress server and complete site takeover.

Affected Products

wpWax Post Grid, Slider & Carousel Ultimate plugin (post-grid-carousel-ultimate)
All versions from n/a through 1.6.10
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-01-27 - CVE-2025-24782 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-24782

Vulnerability Analysis

The vulnerability is classified as Improper Control of Filename for Include/Require Statement in PHP Program [CWE-98]. The plugin accepts user-controlled input and passes it to a PHP file inclusion function without sufficient validation or sanitization. This allows an attacker to manipulate the included path and reference files outside the intended directory.

When the malicious path resolves to an attacker-controlled or sensitive PHP file already present on the server, the PHP interpreter executes its contents. The attack requires network access and low-privilege authentication (PR:L). The flaw impacts confidentiality, integrity, and availability of the host environment.

The EPSS score is 0.338%, placing this issue at the 56th percentile for exploitation likelihood. No public proof-of-concept exploit has been published at the time of writing.

Root Cause

The root cause is unsanitized user input being concatenated into a PHP include or require call. The plugin fails to apply an allowlist of permitted templates or to canonicalize the resulting path against a fixed base directory. This omission enables path traversal sequences such as ../ to escape the intended template directory.

Attack Vector

An authenticated user with at least Contributor-level privileges submits a request to a vulnerable plugin endpoint with a manipulated filename parameter. The plugin appends the input to a base path and passes the result to include. The attacker can target arbitrary .php files on the host filesystem, including log files poisoned with PHP code, uploaded media containing PHP payloads, or session files. Execution of the included file runs in the context of the PHP-FPM or web server user.

No verified exploitation code is available. Refer to the Patchstack advisory for technical specifics.

Detection Methods for CVE-2025-24782

Indicators of Compromise

HTTP requests to plugin endpoints containing ../, encoded traversal sequences (%2e%2e%2f), or absolute paths in parameters that map to template names
Web server access logs showing authenticated POST or GET requests referencing unexpected .php files or system paths like /etc/passwd
New or modified PHP files in the wp-content/uploads/ directory that should not contain executable code
Unexpected PHP processes spawning shell utilities such as bash, sh, curl, or wget

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for path traversal patterns directed at post-grid-carousel-ultimate URLs
Hunt for include/require failures or PHP warnings referencing unusual file paths in PHP error logs
Monitor WordPress user activity for low-privilege accounts performing template or shortcode operations outside normal behavior

Monitoring Recommendations

Enable verbose logging on the PHP runtime to capture file inclusion events and error conditions
Forward WordPress, web server, and PHP logs to a centralized SIEM for correlation and retention
Establish baselines for normal plugin request patterns to identify deviations that suggest LFI probing

How to Mitigate CVE-2025-24782

Immediate Actions Required

Update the wpWax Post Grid, Slider & Carousel Ultimate plugin to a version later than 1.6.10 as soon as the vendor publishes a fix
Audit existing WordPress user accounts and remove unused low-privilege accounts that could be leveraged by attackers
Review wp-content/uploads/ and other writable directories for unauthorized PHP files and remove any that are not legitimate

Patch Information

The vulnerability is reported against versions up to and including 1.6.10. Administrators should monitor the Patchstack advisory and the WordPress plugin repository for an official patched release and apply it immediately upon availability.

Workarounds

Deactivate and remove the plugin until a patched version is released if the functionality is non-essential
Deploy a WAF rule that blocks requests to plugin endpoints containing path traversal sequences or absolute filesystem paths
Configure PHP open_basedir to restrict file inclusion to specific directories, limiting the impact of any successful LFI attempt
Disable PHP execution in writable directories such as wp-content/uploads/ via web server configuration

bash

# Example Apache configuration to disable PHP execution in uploads
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.php$">
        Require all denied
    </FilesMatch>
</Directory>

# Example php.ini hardening
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off
allow_url_fopen = Off