CVE-2025-31015: MailHawk Path Traversal Vulnerability

CVE-2025-31015 Overview

CVE-2025-31015 is a PHP Local File Inclusion (LFI) vulnerability in the Adrian Tobey MailHawk WordPress plugin, which provides SMTP service and email delivery functionality. The flaw affects all versions of MailHawk up to and including 1.3.1. The vulnerability stems from improper control of filenames used in PHP include/require statements, classified under [CWE-98]. Successful exploitation lets attackers include and execute local PHP files within the WordPress server context, potentially leading to remote code execution, sensitive data disclosure, and full site compromise.

Critical Impact
Attackers who induce user interaction can include arbitrary local PHP files through the MailHawk plugin, compromising confidentiality, integrity, and availability of WordPress sites running versions ≤ 1.3.1.

Affected Products

Adrian Tobey MailHawk (WordPress SMTP Service / Email Delivery plugin)
MailHawk versions from n/a through <= 1.3.1
WordPress installations using the vulnerable MailHawk plugin

Discovery Timeline

2025-04-11 - CVE-2025-31015 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-31015

Vulnerability Analysis

The MailHawk plugin fails to properly validate filenames passed to PHP include or require statements. This is a classic PHP File Inclusion weakness tracked under [CWE-98]. An unauthenticated attacker can craft a request that manipulates a filename parameter consumed by the plugin's inclusion logic. When the plugin processes the request, PHP loads and executes the referenced file from the local file system within the WordPress runtime context.

Because the inclusion executes server-side PHP, the impact extends beyond information disclosure. Attackers can chain LFI with log poisoning, session file abuse, or uploaded media files to achieve arbitrary code execution. The CVSS vector indicates network exploitation with required user interaction, which aligns with attacks delivered through crafted links or administrator-targeted phishing.

Root Cause

The root cause is missing or insufficient sanitization of user-controlled input used to construct an inclusion path. The MailHawk plugin accepts a parameter that is concatenated into a PHP include/require call without enforcing an allowlist of permitted files or normalizing the resolved path. This allows traversal sequences and references to attacker-controlled local files.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker delivers a crafted URL to an authenticated user, typically a site administrator. When the user visits the link, the vulnerable plugin endpoint processes the request and includes the attacker-specified local file. The included file is executed as PHP, granting the attacker the privileges of the WordPress process. No verified public exploit code or proof-of-concept is currently published in CISA KEV or ExploitDB.

For full technical details, see the Patchstack WordPress Vulnerability Advisory.

Detection Methods for CVE-2025-31015

Indicators of Compromise

HTTP requests to MailHawk plugin endpoints containing path traversal sequences such as ../, ..%2f, or null byte variants
Unexpected PHP errors in web server logs referencing include() or require() calls with unusual file paths
Web access logs showing parameter values pointing to /etc/passwd, wp-config.php, uploaded media files, or session/log files
New or modified PHP files in wp-content/uploads/ or other writable directories following requests to MailHawk endpoints

Detection Strategies

Inspect web server and WordPress access logs for requests targeting MailHawk plugin URLs with file path parameters
Deploy a web application firewall (WAF) rule that blocks directory traversal patterns and known LFI payloads against /wp-content/plugins/mailhawk/ paths
Monitor PHP error logs for failed to open stream and include() warnings tied to MailHawk components
Use file integrity monitoring on WordPress core and plugin directories to detect unauthorized file changes

Monitoring Recommendations

Enable verbose logging on the WordPress host and forward logs to a centralized SIEM or data lake for correlation
Alert on outbound network connections initiated by the PHP process to unexpected destinations
Track plugin inventory across WordPress fleets to identify hosts running MailHawk <= 1.3.1
Continuously scan for newly published proof-of-concept exploits referencing CVE-2025-31015

How to Mitigate CVE-2025-31015

Immediate Actions Required

Update MailHawk to a patched version above 1.3.1 as soon as the vendor releases a fix
If no patched version is available, deactivate and remove the MailHawk plugin from affected WordPress installations
Audit web server logs for prior exploitation attempts dating back to before the public disclosure
Rotate WordPress secrets, database credentials, and API keys if compromise is suspected

Patch Information

Consult the Patchstack WordPress Vulnerability Advisory for current patch status and vendor remediation guidance. Apply the vendor-supplied update through the WordPress plugin manager once available, and verify the installed version is above 1.3.1.

Workarounds

Restrict access to WordPress administrative endpoints using IP allowlists or VPN-only access
Deploy WAF rules blocking traversal sequences and remote file inclusion patterns against MailHawk endpoints
Set PHP open_basedir to confine file access to the WordPress installation directory
Disable PHP allow_url_include in php.ini to prevent remote inclusion escalation

bash

# Configuration example: php.ini hardening
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = exec,passthru,shell_exec,system,proc_open,popen