CVE-2025-25141: Fami Sales Popup LFI Vulnerability

CVE-2025-25141 Overview

CVE-2025-25141 is a Local File Inclusion (LFI) vulnerability in the Fami Sales Popup WordPress plugin developed by zankover. The flaw stems from improper control of filenames used in PHP include or require statements, classified under [CWE-98]. Attackers can supply attacker-controlled paths to load arbitrary local files through the plugin's PHP execution context. The issue affects all versions of Fami Sales Popup up to and including 2.0.0. Successful exploitation requires user interaction and high attack complexity, but yields full impact on confidentiality, integrity, and availability of the targeted WordPress site.

Critical Impact
Successful exploitation allows attackers to include and execute arbitrary local PHP files, leading to information disclosure and potential remote code execution on the WordPress host.

Affected Products

zankover Fami Sales Popup plugin for WordPress (fami-sales-popup)
All versions from initial release through 2.0.0
WordPress installations running the vulnerable plugin

Discovery Timeline

2025-02-07 - CVE-2025-25141 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-25141

Vulnerability Analysis

The vulnerability lies in how the Fami Sales Popup plugin constructs file paths passed to PHP include or require functions. The plugin accepts user-influenced input and concatenates it into a filename argument without sufficient validation or allowlisting. PHP then resolves and executes the referenced file within the application's privilege context.

This class of flaw, tracked as [CWE-98], can escalate from local file disclosure to code execution when an attacker controls a file containing PHP directives. On a typical WordPress host, that includes log files, uploaded media, or session files. The EPSS probability of 1.131% places this CVE in the 78th percentile of vulnerabilities likely to be exploited within 30 days.

Root Cause

The root cause is missing sanitization of a filename parameter consumed by an include, include_once, require, or require_once statement. The plugin does not enforce an allowlist of permitted templates and does not strip path traversal sequences such as ../. Any string reaching the include function is treated as a valid PHP source path.

Attack Vector

The attack vector is network-based and requires user interaction, meaning an authenticated user or administrator must trigger the vulnerable request path. An attacker crafts a malicious link or request that supplies a path to a local file, then induces a user to load it. PHP loads the referenced file from disk and executes any embedded code under the WordPress process identity.

No verified public proof-of-concept code is published for CVE-2025-25141. See the Patchstack Vulnerability Advisory for technical details on the affected code paths.

Detection Methods for CVE-2025-25141

Indicators of Compromise

HTTP requests to fami-sales-popup plugin endpoints containing ../, ..%2f, or absolute filesystem paths in query or POST parameters
Web server logs showing PHP include warnings referencing files outside the plugin directory
Unexpected PHP processes spawning shell utilities such as sh, bash, or wget from the web server user
Access to sensitive files like wp-config.php, /etc/passwd, or PHP session storage from the plugin context

Detection Strategies

Inspect WordPress access logs for parameters routing into the Fami Sales Popup plugin with path traversal markers
Enable PHP error logging and alert on failed to open stream or include() warnings tied to the plugin
Deploy a Web Application Firewall (WAF) rule that blocks traversal sequences and null bytes on plugin endpoints
Correlate user-interaction events such as referer headers from external domains with subsequent plugin file inclusions

Monitoring Recommendations

Monitor file integrity on wp-content/plugins/fami-sales-popup/ and the wider WordPress installation for unexpected writes
Track outbound network connections from the PHP-FPM or Apache process to detect post-exploitation callbacks
Audit WordPress administrator and editor sessions for visits to URLs containing plugin parameters with suspicious values
Centralize logs from WordPress, the web server, and PHP into a SIEM for cross-source correlation

How to Mitigate CVE-2025-25141

Immediate Actions Required

Deactivate the Fami Sales Popup plugin until a patched release is confirmed available and installed
Restrict administrative access to WordPress and require multi-factor authentication for privileged users
Apply WAF rules that block path traversal patterns and unexpected file extensions in plugin parameters
Review web server and PHP error logs from February 2025 onward for evidence of prior exploitation

Patch Information

No fixed version is documented at the time of publication. Versions through 2.0.0 of fami-sales-popup remain affected. Monitor the Patchstack Vulnerability Advisory and the WordPress plugin directory for vendor updates. If a patched version is not released, replace the plugin with an alternative sales notification solution.

Workarounds

Remove the plugin directory wp-content/plugins/fami-sales-popup/ entirely if the plugin is not business-critical
Set PHP open_basedir to confine include paths to the WordPress installation directory
Disable allow_url_include in php.ini to prevent escalation to remote file inclusion scenarios
Run PHP under a least-privilege user account with read-only access to WordPress core files

bash

# Configuration example: harden php.ini against file inclusion abuse
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html/wordpress:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"