CVE-2025-26985: Majestic Support File Inclusion Flaw

CVE-2025-26985 Overview

CVE-2025-26985 is a Local File Inclusion (LFI) vulnerability affecting the Majestic Support WordPress plugin. The vulnerability stems from improper control of filename parameters used in PHP include/require statements, allowing attackers to include arbitrary local files from the server. This can lead to information disclosure, remote code execution under certain conditions, and complete compromise of the affected WordPress installation.

Critical Impact

This LFI vulnerability allows unauthenticated attackers to read sensitive files from the server and potentially achieve remote code execution through log poisoning or other file inclusion techniques.

Affected Products

• Majestic Support WordPress Plugin version 1.0.6 and earlier
• WordPress installations using vulnerable versions of the Majestic Support plugin

Discovery Timeline

• 2025-02-25 - CVE CVE-2025-26985 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-26985

Vulnerability Analysis

This vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Majestic Support plugin fails to properly validate and sanitize user-supplied input before passing it to PHP's file inclusion functions such as include(), include_once(), require(), or require_once(). This allows an attacker to manipulate the file path parameter to include arbitrary files from the local file system.

The vulnerability exists in the plugin's file handling mechanism where user-controlled input is concatenated directly into file paths without adequate validation. Attackers can exploit this by using directory traversal sequences (such as ../) to escape the intended directory and access sensitive files like /etc/passwd, wp-config.php, or application log files.

Root Cause

The root cause of this vulnerability is insufficient input validation on user-supplied parameters that are used to construct file paths for PHP include statements. The plugin does not properly sanitize or restrict the characters and path sequences allowed in the filename parameter, enabling path traversal attacks. Additionally, the absence of a whitelist approach for allowed files leaves the inclusion mechanism open to abuse.

Attack Vector

The attack is network-based and can be executed remotely without authentication. An attacker crafts a malicious HTTP request containing directory traversal sequences in the vulnerable parameter. The PHP application processes this input and includes the attacker-specified file. Common attack patterns include:

• Reading sensitive configuration files like wp-config.php to obtain database credentials
• Accessing /etc/passwd for user enumeration on Linux servers
• Including log files (such as access logs or error logs) that may have been poisoned with malicious PHP code
• Chaining with file upload functionality to achieve remote code execution

The vulnerability manifests through improper handling of file path parameters in the Majestic Support plugin. Attackers can leverage path traversal sequences to escape the intended directory structure and access arbitrary files on the server. For detailed technical analysis, refer to the Patchstack security advisory.

Detection Methods for CVE-2025-26985

Indicators of Compromise

• Unusual HTTP requests containing path traversal sequences (../, ..%2f, ..%5c) targeting the Majestic Support plugin
• Access attempts to sensitive files such as wp-config.php, /etc/passwd, or system log files through plugin endpoints
• Web server logs showing repeated requests with encoded directory traversal patterns
• Unexpected file access errors in application logs indicating failed inclusion attempts

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block path traversal patterns in request parameters
• Implement monitoring for requests containing encoded traversal sequences (%2e%2e%2f, %252e%252e%252f)
• Use file integrity monitoring (FIM) to detect unauthorized access to sensitive configuration files
• Analyze web server access logs for suspicious patterns targeting the /wp-content/plugins/majestic-support/ directory

Monitoring Recommendations

• Enable verbose logging for WordPress and monitor for file inclusion errors
• Set up alerts for high-frequency requests from single IP addresses targeting plugin endpoints
• Monitor for successful reads of sensitive files through correlation of web logs with file access events
• Implement network-level monitoring for outbound connections that may indicate successful exploitation

How to Mitigate CVE-2025-26985

Immediate Actions Required

• Immediately disable or remove the Majestic Support plugin if running version 1.0.6 or earlier
• Review web server logs for evidence of exploitation attempts
• Check for unauthorized file access or modifications to sensitive files
• Consider implementing virtual patching through a WAF if the plugin cannot be immediately removed

Patch Information

Organizations should check for updated versions of the Majestic Support plugin that address this vulnerability. Consult the Patchstack vulnerability database for the latest patch status and remediation guidance. If no patch is available, consider replacing the plugin with a secure alternative.

Workarounds

• Disable the Majestic Support plugin until a security update is available
• Implement WAF rules to block requests containing path traversal patterns targeting the plugin
• Restrict file system permissions to limit the impact of potential file inclusion attacks
• Use PHP configuration settings such as open_basedir to restrict file access to the WordPress directory

# Apache .htaccess configuration to block path traversal attempts
# Add to WordPress root .htaccess file

# Block requests with path traversal patterns
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC,OR]
RewriteCond %{QUERY_STRING} (%2e%2e%2f|%2e%2e/|\.%2e/|%2e\.\/) [NC]
RewriteRule .* - [F,L]

# Alternatively, disable the vulnerable plugin directory
<Directory "/var/www/html/wp-content/plugins/majestic-support">
    Deny from all
</Directory>