CVE-2025-30835: WooCommerce Accounting File Inclusion Flaw

CVE-2025-30835 Overview

CVE-2025-30835 is a PHP Local File Inclusion (LFI) vulnerability affecting the Accounting for WooCommerce WordPress plugin developed by Bastien Ho. The vulnerability stems from improper control of filename parameters used in PHP include/require statements, allowing attackers to include local files from the server's filesystem. This can lead to sensitive information disclosure, remote code execution through log poisoning techniques, or complete server compromise.

Critical Impact

This Local File Inclusion vulnerability allows unauthenticated or low-privileged attackers to potentially read sensitive configuration files, source code, and system files on the web server, which can escalate to remote code execution.

Affected Products

• Accounting for WooCommerce plugin versions through 1.6.8
• WordPress installations running vulnerable versions of the plugin
• WooCommerce-enabled sites with the affected plugin installed

Discovery Timeline

• 2025-03-31 - CVE CVE-2025-30835 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-30835

Vulnerability Analysis

This vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Accounting for WooCommerce plugin fails to properly sanitize user-supplied input before using it in PHP file inclusion functions such as include(), include_once(), require(), or require_once().

The network-based attack vector means exploitation can occur remotely through specially crafted HTTP requests. While the attack complexity is high and requires user interaction, successful exploitation can result in complete compromise of confidentiality, integrity, and availability of the affected system. Attackers who exploit this flaw could potentially read sensitive files like wp-config.php containing database credentials, access system files such as /etc/passwd, or chain the vulnerability with other techniques to achieve remote code execution.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization within the plugin's PHP codebase. The Accounting for WooCommerce plugin accepts user-controllable input that is directly or indirectly passed to PHP file inclusion functions without proper filtering or whitelisting. This allows attackers to manipulate file paths using techniques such as directory traversal sequences (../) to reference files outside the intended directory scope.

Attack Vector

The vulnerability is exploitable over the network, requiring an attacker to send specially crafted requests to the WordPress site running the vulnerable plugin. The attack involves manipulating parameters that control which files are included by the PHP application. By injecting path traversal sequences or absolute file paths, an attacker can force the application to include arbitrary local files.

Typical exploitation scenarios include:

• Including /etc/passwd to enumerate system users
• Reading wp-config.php to obtain database credentials
• Accessing log files that may contain injected PHP code (log poisoning)
• Reading sensitive plugin or theme files containing hardcoded credentials

The vulnerability is documented in the Patchstack Vulnerability Report for additional technical details on the exploitation mechanism.

Detection Methods for CVE-2025-30835

Indicators of Compromise

• Unusual HTTP requests containing path traversal sequences like ../ or ..%2f targeting the Accounting for WooCommerce plugin endpoints
• Web server logs showing access attempts to sensitive system files such as /etc/passwd or wp-config.php
• PHP error logs indicating file inclusion failures or attempts to access files outside the web root
• Anomalous file access patterns in WordPress plugin directories

Detection Strategies

• Configure Web Application Firewall (WAF) rules to detect and block path traversal patterns in request parameters
• Implement file integrity monitoring on critical WordPress configuration files and plugin directories
• Enable detailed PHP error logging and monitor for inclusion-related errors
• Deploy intrusion detection signatures targeting LFI attack patterns specific to WordPress plugins

Monitoring Recommendations

• Monitor web server access logs for requests containing encoded traversal sequences (%2e%2e%2f, %252e%252e%252f)
• Set up alerts for any access to /etc/passwd, /etc/shadow, or WordPress configuration files from plugin endpoints
• Track and investigate any new or modified files in the WordPress uploads directory that may indicate successful code injection
• Review plugin activity logs for unexpected file operations or parameter tampering

How to Mitigate CVE-2025-30835

Immediate Actions Required

• Immediately update the Accounting for WooCommerce plugin to the latest available version that addresses this vulnerability
• If no patch is available, temporarily disable the Accounting for WooCommerce plugin until a fix is released
• Implement WAF rules to block path traversal attempts targeting WordPress plugin endpoints
• Review server access logs for any evidence of exploitation attempts or successful compromise
• Consider restricting file system permissions to limit the impact of potential LFI exploitation

Patch Information

Organizations should monitor the official Accounting for WooCommerce plugin page and the Patchstack vulnerability database for updates regarding security patches. The vulnerability affects versions through 1.6.8, so users should update to any version newer than 1.6.8 once available.

Workarounds

• Deploy a Web Application Firewall with rules specifically configured to block path traversal and LFI attempts
• Implement PHP open_basedir restrictions to limit file access to the WordPress directory and necessary system directories
• Use disable_functions in php.ini to disable dangerous functions if not required by the application
• Consider using a WordPress security plugin that provides real-time protection against file inclusion attacks
• Apply least privilege principles to the web server user to minimize the impact of successful exploitation

# Example PHP configuration hardening in php.ini
# Restrict file operations to specific directories
open_basedir = /var/www/html/wordpress:/tmp

# Disable dangerous functions if not needed
disable_functions = exec,passthru,shell_exec,system,proc_open,popen

# Log PHP errors for monitoring
log_errors = On
error_log = /var/log/php/error.log