CVE-2025-31014: Material Dashboard LFI Vulnerability

CVE-2025-31014 Overview

CVE-2025-31014 is a Local File Inclusion (LFI) vulnerability in the Hossein Material Dashboard WordPress plugin. The flaw stems from improper control of filenames passed to PHP include or require statements [CWE-98]. Attackers with low-privilege authenticated access can coerce the application into loading arbitrary local PHP files, leading to code execution within the WordPress context.

The vulnerability affects Material Dashboard versions through 1.4.5. Network-based exploitation is feasible, though the CVSS vector indicates higher attack complexity. The Exploit Prediction Scoring System (EPSS) places this vulnerability at the 54th percentile.

Critical Impact
Successful exploitation allows attackers to include arbitrary local PHP files, resulting in code execution, confidentiality loss, and full compromise of the WordPress site backend.

Affected Products

Hossein Material Dashboard plugin for WordPress
All versions up to and including 1.4.5
WordPress sites with the plugin activated

Discovery Timeline

2025-04-11 - CVE-2025-31014 published to the National Vulnerability Database (NVD)
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-31014

Vulnerability Analysis

The Material Dashboard plugin fails to properly sanitize user-controlled input that is later passed to PHP file inclusion functions. PHP include, include_once, require, and require_once statements execute any PHP code contained in the included file. When the filename argument is influenced by attacker input, an adversary can redirect inclusion to unintended files on the local filesystem.

This class of weakness is tracked as [CWE-98]: Improper Control of Filename for Include/Require Statement in PHP Program. Although the CVE title references Remote File Inclusion (RFI), the documented impact is Local File Inclusion (LFI). The vulnerability requires authenticated access, limiting the attacker pool to users with valid plugin permissions.

Root Cause

The root cause is unsanitized input flowing into a PHP file inclusion sink. The plugin trusts request parameters that designate which file to load, without validating against an allowlist or stripping path traversal sequences such as ../. This pattern allows attackers to traverse the filesystem and include sensitive PHP files, log files, or uploaded content.

Attack Vector

An authenticated attacker submits a crafted HTTP request to a vulnerable plugin endpoint, supplying a manipulated filename parameter. The PHP interpreter then resolves the path and executes the contents of the targeted file. Common exploitation techniques include log poisoning, session file inclusion, and inclusion of attacker-uploaded media containing embedded PHP. Refer to the Patchstack WordPress Vulnerability Report for technical details.

Detection Methods for CVE-2025-31014

Indicators of Compromise

HTTP requests to Material Dashboard endpoints containing ../ sequences or absolute filesystem paths in parameters
Web server access logs showing inclusion of files outside the plugin directory such as /etc/passwd, wp-config.php, or PHP session files in /tmp
Unexpected PHP errors referencing include() or require() warnings for non-existent paths
New or modified PHP files appearing in wp-content/uploads/ that contain executable code

Detection Strategies

Inspect WordPress access logs for query strings targeting Material Dashboard scripts with file path parameters
Deploy Web Application Firewall (WAF) rules that block path traversal patterns and null byte injection on plugin URLs
Hash-monitor the plugin directory and wp-content/uploads/ to identify unauthorized file additions
Correlate authenticated session activity with abnormal file access patterns in PHP-FPM logs

Monitoring Recommendations

Forward Apache, Nginx, and PHP error logs to a centralized SIEM for traversal-pattern alerting
Enable WordPress audit logging to track plugin file access by authenticated users
Alert on outbound connections from the web server that follow suspicious LFI requests, indicating potential webshell activity

How to Mitigate CVE-2025-31014

Immediate Actions Required

Deactivate the Hossein Material Dashboard plugin until a patched release is confirmed and installed
Audit user accounts with access to the plugin and revoke unnecessary privileges
Review web server logs for indicators of prior exploitation attempts
Rotate WordPress secrets, database credentials, and administrator passwords if compromise is suspected

Patch Information

No fixed version was identified in the available advisory data. The vulnerability affects Material Dashboard through version 1.4.5. Monitor the Patchstack advisory and the plugin repository for an official patched release.

Workarounds

Remove or disable the plugin until a security update becomes available
Configure WAF rules to block requests containing ../, null bytes, and php:// wrappers on plugin endpoints
Apply open_basedir restrictions in PHP configuration to limit accessible filesystem paths
Set allow_url_include=Off and allow_url_fopen=Off in php.ini to prevent remote inclusion variants

bash

# Example php.ini hardening
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"