CVE-2025-26905: Estatik Path Traversal Vulnerability

CVE-2025-26905 Overview

CVE-2025-26905 is a path traversal vulnerability in the Estatik real estate plugin for WordPress that enables PHP Local File Inclusion (LFI). The flaw affects all versions of Estatik up to and including 4.3.0. An authenticated attacker with low-privilege access can manipulate file path parameters to include arbitrary local PHP files on the server. Successful exploitation can disclose sensitive configuration data and may lead to remote code execution when an attacker controls file content reachable by the web server. The vulnerability is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated path traversal in the Estatik plugin allows PHP Local File Inclusion, exposing sensitive files and risking server-side code execution on affected WordPress installations.

Affected Products

Estatik WordPress plugin versions up to and including 4.3.0
WordPress sites with the vulnerable Estatik plugin active
Hosting environments running PHP-based WordPress installations using Estatik

Discovery Timeline

2025-02-25 - CVE-2025-26905 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2025-26905

Vulnerability Analysis

The Estatik plugin fails to sanitize user-supplied input used to construct filesystem paths. An authenticated attacker submits a crafted parameter containing directory traversal sequences such as ../. The plugin resolves the path and passes it to a PHP file inclusion function, loading files outside the intended directory. The flaw is classified as PHP Local File Inclusion because the included file is executed by the PHP interpreter rather than served as static content. EPSS data places the probability of exploitation at 0.626% (70th percentile), reflecting moderate attacker interest in WordPress plugin LFI bugs.

Root Cause

The root cause is missing canonicalization and allow-list validation of file path parameters before they reach a PHP inclusion sink such as include, require, or their _once variants. The plugin trusts request input to identify template or module files. Without normalizing the path and constraining it to a known base directory, traversal sequences escape the intended scope.

Attack Vector

The attack vector is network-based and requires authenticated access at a low privilege level. An attacker sends an HTTP request to a vulnerable Estatik endpoint with a manipulated file or template parameter. The parameter contains relative path components that traverse out of the plugin directory. The server then includes and executes the targeted PHP file. Targets typically include wp-config.php for credential disclosure and uploaded files placed via other plugin functionality for code execution.

No verified public proof-of-concept code is available. See the Patchstack Estatik Plugin Vulnerability advisory for vendor-provided technical details.

Detection Methods for CVE-2025-26905

Indicators of Compromise

HTTP requests to Estatik plugin endpoints containing ../, ..%2f, or URL-encoded traversal sequences in query or POST parameters
Web server access logs showing inclusion attempts targeting wp-config.php, /etc/passwd, or plugin configuration files
PHP error log entries referencing include() or require() calls with unexpected file paths under wp-content/plugins/estatik/
Unexpected outbound connections or new administrative users following requests to Estatik endpoints

Detection Strategies

Inspect WordPress access logs for requests to Estatik URLs containing path traversal patterns or absolute filesystem paths
Deploy WAF rules that flag traversal sequences in parameters handled by wp-content/plugins/estatik/
Enable PHP open_basedir violations logging to surface inclusion attempts outside the WordPress document root
Run plugin inventory scans to identify any Estatik installation at version 4.3.0 or below

Monitoring Recommendations

Forward WordPress, PHP-FPM, and web server logs to a centralized SIEM for correlation against traversal signatures
Alert on file integrity changes within wp-content/uploads/ and wp-content/plugins/estatik/
Monitor for new or modified PHP files in upload directories that could serve as inclusion targets

How to Mitigate CVE-2025-26905

Immediate Actions Required

Update the Estatik plugin to a version higher than 4.3.0 once a patched release is published by the vendor
Deactivate and remove the Estatik plugin if a patched version is not yet available and the functionality is not business-critical
Audit WordPress user accounts and revoke unnecessary low-privilege roles that could be abused to reach the vulnerable endpoint
Review web server and PHP logs for signs of past exploitation against Estatik endpoints

Patch Information

Refer to the Patchstack advisory for the Estatik plugin for the current patch status and upgrade guidance. Apply the vendor-released update to all affected WordPress sites as soon as it becomes available.

Workarounds

Restrict access to Estatik plugin endpoints via web server rules or WAF policies until a fix is applied
Configure PHP open_basedir to restrict file inclusion to the WordPress installation directory
Set allow_url_include = Off and allow_url_fopen = Off in php.ini to reduce inclusion attack surface
Apply principle of least privilege to WordPress accounts so untrusted users cannot reach authenticated plugin endpoints

bash

# Example php.ini hardening
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"