CVE-2025-26757: FULL Customer File Inclusion Vulnerability

CVE-2025-26757 Overview

CVE-2025-26757 is an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability affecting the FULL Customer WordPress plugin by FULL SERVICES. This vulnerability allows attackers to exploit PHP Local File Inclusion (LFI), potentially enabling unauthorized access to sensitive files on the server. The flaw stems from improper validation of user-supplied input used in PHP include/require statements, which can be leveraged to read arbitrary files or escalate to remote code execution under certain conditions.

Critical Impact

Attackers can exploit this Local File Inclusion vulnerability to read sensitive server files, access configuration data, or potentially achieve remote code execution by including malicious files.

Affected Products

• FULL Customer WordPress Plugin versions through 3.1.26
• WordPress installations using the FULL Customer (FULL Cliente) plugin
• Web servers hosting vulnerable plugin versions

Discovery Timeline

• 2025-02-22 - CVE-2025-26757 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-26757

Vulnerability Analysis

This vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The FULL Customer WordPress plugin fails to properly sanitize user-controlled input before using it in PHP include or require statements. This allows an attacker to manipulate the file path and include arbitrary local files from the server's filesystem.

Local File Inclusion vulnerabilities in WordPress plugins are particularly dangerous because they can expose sensitive configuration files such as wp-config.php, which contains database credentials and authentication keys. Additionally, if combined with other vulnerabilities or misconfigurations (such as log file poisoning), LFI can be escalated to achieve remote code execution.

The attack requires network access and user interaction, but no authentication is needed to exploit the vulnerability. Successful exploitation could result in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of this vulnerability lies in the improper handling of user-supplied input within the FULL Customer plugin's PHP code. The plugin uses include or require statements with parameters that can be influenced by attackers without adequate validation, sanitization, or restriction to a safe set of files. This allows path traversal sequences or direct file references to be injected, enabling access to files outside the intended scope.

Attack Vector

The attack vector is network-based, requiring an attacker to send specially crafted HTTP requests to a WordPress site running the vulnerable plugin. The attacker can manipulate parameters passed to vulnerable PHP include/require statements to traverse directories and include local files.

A typical exploitation scenario involves:

1. Identifying a WordPress installation using the FULL Customer plugin version 3.1.26 or earlier
2. Crafting a malicious request with path traversal sequences (e.g., ../../../) targeting sensitive files
3. Accessing the vulnerable endpoint to include and read the contents of local files such as /etc/passwd or wp-config.php
4. Potentially escalating the attack by poisoning log files or combining with file upload vulnerabilities to achieve code execution

For detailed technical information about this vulnerability, see the Patchstack security advisory.

Detection Methods for CVE-2025-26757

Indicators of Compromise

• Unusual HTTP requests containing path traversal sequences such as ../, ..%2f, or ....// targeting the FULL Customer plugin endpoints
• Web server logs showing attempts to access sensitive files like /etc/passwd, wp-config.php, or system configuration files
• Unexpected file access patterns or error messages related to file inclusion in PHP logs
• Requests with encoded characters attempting to bypass input filters

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in request parameters
• Monitor web server access logs for suspicious requests targeting the /wp-content/plugins/full-customer/ directory with unusual parameters
• Deploy intrusion detection systems with signatures for common LFI attack patterns
• Use WordPress security plugins to scan for vulnerable plugin versions

Monitoring Recommendations

• Enable verbose logging for the WordPress installation and review logs regularly for anomalous activity
• Set up alerts for any file access attempts outside the WordPress directory structure
• Monitor for failed PHP include/require operations which may indicate exploitation attempts
• Implement file integrity monitoring on critical configuration files

How to Mitigate CVE-2025-26757

Immediate Actions Required

• Update the FULL Customer (FULL Cliente) plugin to the latest patched version immediately
• If an update is not available, deactivate and remove the vulnerable plugin until a patch is released
• Review web server logs for signs of exploitation attempts
• Audit any sensitive files that may have been accessed if compromise is suspected

Patch Information

Organizations should check the Patchstack vulnerability database for the latest patch information and update details from FULL SERVICES. All versions of the FULL Customer plugin through 3.1.26 are affected and should be updated to a patched version when available.

Workarounds

• Temporarily disable or remove the FULL Customer plugin if a patch is not yet available
• Implement Web Application Firewall rules to block requests containing path traversal sequences
• Restrict file system permissions to limit the impact of potential file inclusion attacks
• Use PHP open_basedir restrictions to limit the directories accessible to PHP scripts

# Apache .htaccess configuration to block path traversal attempts
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./) [NC,OR]
    RewriteCond %{QUERY_STRING} (\.\.%2f) [NC,OR]
    RewriteCond %{REQUEST_URI} (\.\./) [NC]
    RewriteRule .* - [F,L]
</IfModule>