CVE-2025-28916: Docpro PHP File Inclusion Vulnerability

CVE-2025-28916 Overview

CVE-2025-28916 is a critical PHP Local File Inclusion (LFI) vulnerability affecting the WordPress Docpro plugin. The vulnerability stems from improper control of filename for include/require statements in PHP, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). This flaw allows unauthenticated attackers to include arbitrary local files on the target server, potentially leading to sensitive data disclosure, authentication bypass, or remote code execution when combined with other attack techniques.

Critical Impact

This vulnerability allows unauthenticated attackers to exploit PHP Local File Inclusion to read sensitive server files, potentially exposing credentials, configuration data, and enabling further system compromise.

Affected Products

• Docpro WordPress Plugin versions up to and including 2.0.1
• WordPress installations with Docpro plugin installed

Discovery Timeline

• 2025-03-26 - CVE-2025-28916 published to NVD
• 2025-03-27 - Last updated in NVD database

Technical Details for CVE-2025-28916

Vulnerability Analysis

This vulnerability is rooted in the improper handling of user-controlled input within PHP include or require statements in the Docpro WordPress plugin. When a PHP application fails to properly sanitize or validate filenames before passing them to include/require functions, attackers can manipulate the input to specify arbitrary file paths on the local system.

The attack is network-accessible and requires no authentication or user interaction, making it particularly dangerous for public-facing WordPress installations. An attacker can potentially read sensitive configuration files such as wp-config.php, access server credentials, view log files containing sensitive information, or leverage the vulnerability for code execution if writable files containing attacker-controlled content exist on the server.

Root Cause

The root cause is inadequate input validation and sanitization of user-supplied data before it is used in PHP file inclusion functions. The Docpro plugin fails to properly restrict the filename parameter, allowing path traversal sequences (such as ../) or direct file paths to be injected. This is a classic example of CWE-98, where the application does not properly control what files can be included through PHP's include(), require(), include_once(), or require_once() functions.

Attack Vector

The vulnerability is exploitable over the network without requiring authentication. An attacker can craft malicious HTTP requests to the vulnerable WordPress installation, manipulating parameters processed by the Docpro plugin to include arbitrary local files. Common exploitation techniques include:

• Using path traversal sequences to navigate to sensitive system files like /etc/passwd or WordPress configuration files
• Including PHP session files or log files that may contain injected PHP code
• Accessing backup files or database dumps stored on the server

For detailed technical analysis, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-28916

Indicators of Compromise

• Unusual HTTP requests containing path traversal patterns such as ../ or ..%2f targeting Docpro plugin endpoints
• Web server logs showing access attempts to sensitive system files through the plugin
• Unexpected file read operations in PHP error logs originating from Docpro plugin files
• Access patterns attempting to retrieve wp-config.php or other WordPress core configuration files

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal attempts in request parameters
• Monitor web server access logs for suspicious patterns targeting the Docpro plugin directory
• Deploy file integrity monitoring to detect unauthorized access to sensitive configuration files
• Enable PHP error logging and monitor for include/require failures indicating exploitation attempts

Monitoring Recommendations

• Configure SIEM alerts for path traversal patterns in web traffic destined for WordPress installations
• Monitor for anomalous file access patterns on WordPress servers, particularly reads of configuration files
• Implement network-based detection for LFI attack signatures in HTTP traffic
• Review plugin-specific access logs for unusual request patterns or parameter manipulation

How to Mitigate CVE-2025-28916

Immediate Actions Required

• Immediately disable or remove the Docpro plugin from all WordPress installations until a patched version is available
• Review web server logs for evidence of exploitation attempts targeting this vulnerability
• Audit WordPress installations for any unauthorized file access or system compromise
• Implement WAF rules to block path traversal attempts as a temporary mitigation measure

Patch Information

At the time of publication, the vulnerability affects Docpro plugin versions through 2.0.1. WordPress administrators should monitor the plugin repository and vendor communications for security updates. Review the Patchstack Vulnerability Report for the latest remediation guidance.

Workarounds

• Remove or deactivate the Docpro plugin until an official patch is released
• Implement strict WAF rules to filter path traversal sequences in all request parameters
• Use PHP open_basedir restrictions to limit file access to the WordPress directory
• Configure web server access controls to restrict sensitive file access at the filesystem level

# Example: Disable Docpro plugin via WP-CLI
wp plugin deactivate docpro --path=/var/www/html/wordpress

# Example: Add open_basedir restriction in php.ini
# open_basedir = /var/www/html/wordpress:/tmp