CVE-2025-26957: Affiliate Coupons Path Traversal Flaw

CVE-2025-26957 Overview

CVE-2025-26957 is a Local File Inclusion (LFI) vulnerability in the Deetronix Affiliate Coupons plugin for WordPress. The flaw stems from improper control of a filename passed to a PHP include or require statement, classified under [CWE-98]. It affects all versions of the affiliate-coupons plugin up to and including 1.7.3. An authenticated attacker with low privileges can abuse the vulnerable parameter to include arbitrary PHP files from the underlying server. Successful exploitation can lead to disclosure of sensitive configuration data, execution of attacker-controlled PHP, and full compromise of the WordPress installation.

Critical Impact
An attacker with low-privileged access can include arbitrary local PHP files, resulting in code execution and full compromise of the WordPress site.

Affected Products

Deetronix Affiliate Coupons plugin for WordPress
All versions from n/a through 1.7.3
WordPress sites running the vulnerable affiliate-coupons plugin

Discovery Timeline

2025-02-25 - CVE-2025-26957 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-26957

Vulnerability Analysis

The Affiliate Coupons plugin passes attacker-influenced input into a PHP file inclusion statement without sufficient validation. This is categorized as Improper Control of Filename for Include/Require Statement in PHP Program under [CWE-98]. Although the CWE name references PHP Remote File Inclusion, the confirmed impact for this plugin is Local File Inclusion. An attacker can traverse the filesystem and force the plugin to include PHP files that were never intended to be exposed through the web application. Because included files are executed in the PHP context of the WordPress process, the attack surface extends beyond information disclosure to arbitrary code execution when combined with any writable file on the server, such as uploads, logs, or session files.

Root Cause

The root cause is missing or insufficient sanitization on a parameter that ultimately reaches a PHP include, include_once, require, or require_once call. The plugin does not restrict the value to a fixed allowlist of file identifiers, and it does not strip directory traversal sequences such as ../. As a result, attacker-supplied input can escape the intended plugin directory and reference other files on the local filesystem.

Attack Vector

Exploitation requires network access to the target WordPress site and a low-privileged authenticated session. The attacker sends a crafted HTTP request to the vulnerable plugin endpoint, supplying a path or filename value that resolves outside the plugin's expected directory. The PHP interpreter then loads and executes that file. Refer to the Patchstack Vulnerability Report for advisory details.

No verified public proof-of-concept code is available. The vulnerability mechanism is described in prose only, in line with the referenced advisory.

Detection Methods for CVE-2025-26957

Indicators of Compromise

Web server access logs containing directory traversal patterns such as ../, ..%2f, or encoded null bytes targeting Affiliate Coupons plugin endpoints under /wp-content/plugins/affiliate-coupons/.
Unexpected PHP errors or warnings referencing include, require, or failed to open stream originating from the plugin.
Access to sensitive files such as wp-config.php, /etc/passwd, or PHP session files via HTTP requests to plugin URLs.

Detection Strategies

Deploy WAF rules that flag path traversal sequences and absolute file paths in query parameters targeting affiliate-coupons endpoints.
Monitor authenticated WordPress sessions for anomalous parameter values that reference file paths or PHP extensions.
Correlate PHP E_WARNING events for file inclusion functions with the source HTTP request to identify probing attempts.

Monitoring Recommendations

Enable verbose access logging on the WordPress site and forward logs to a centralized SIEM for retention and analysis.
Alert on any successful HTTP 200 response to plugin URLs that also contain filesystem path characters in parameters.
Track outbound network connections and new PHP file writes under wp-content/uploads/ as post-exploitation indicators.

How to Mitigate CVE-2025-26957

Immediate Actions Required

Identify all WordPress installations running the Affiliate Coupons plugin at version 1.7.3 or earlier.
Deactivate and remove the plugin until a fixed release is available and verified.
Rotate any credentials, API keys, and salts stored in wp-config.php if exploitation is suspected.
Review web server, PHP, and WordPress audit logs for signs of file inclusion attempts.

Patch Information

At the time of publication, the Patchstack advisory lists all versions through 1.7.3 as affected. Administrators should monitor the vendor's plugin page and Patchstack for a patched release and apply it immediately once published.

Workarounds

Remove or deactivate the affiliate-coupons plugin until a vendor patch is released.
Restrict access to WordPress admin and authenticated endpoints using IP allowlists or VPN-only access.
Configure PHP with open_basedir to constrain file inclusion to explicit directories and disable allow_url_include.
Deploy WAF signatures that block path traversal and PHP wrapper schemes such as php:// and file:// in request parameters.

bash

# Example php.ini hardening to limit file inclusion impact
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"