CVE-2025-31070: HTML5 Radio Player Path Traversal Flaw

CVE-2025-31070 Overview

CVE-2025-31070 is a path traversal vulnerability in the LambertGroup HTML5 Radio Player WPBakery Page Builder Addon (lbg-cleverbakery) for WordPress. The flaw affects all plugin versions up to and including 2.5. Attackers can supply crafted pathnames to read files outside the intended directory, resulting in arbitrary file download. The vulnerability is network-exploitable, requires no authentication, and needs no user interaction. The issue is tracked under CWE-22 (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Unauthenticated remote attackers can download arbitrary files from the WordPress host, exposing configuration files, credentials, and other sensitive data.

Affected Products

LambertGroup HTML5 Radio Player - WPBakery Page Builder Addon (lbg-cleverbakery)
Plugin versions from n/a through 2.5 (inclusive)
WordPress sites running the addon as a WPBakery Page Builder extension

Discovery Timeline

2025-07-16 - CVE-2025-31070 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-31070

Vulnerability Analysis

The plugin exposes a file-handling endpoint that accepts a user-controlled path parameter and returns the contents of the referenced file. The endpoint does not constrain the input to a safe base directory and does not normalize traversal sequences such as ../. An unauthenticated attacker can therefore reference files outside the plugin's intended scope.

Successful exploitation results in arbitrary file download. Useful targets include wp-config.php, which stores database credentials and authentication keys, and server-side files such as /etc/passwd on Linux hosts. Leaked WordPress secrets enable downstream attacks including database access, cookie forgery, and full site takeover.

Root Cause

The root cause is missing input validation on a filename or path parameter in the plugin's file delivery handler. The code concatenates attacker-supplied input into a filesystem path without canonicalizing the result or verifying it resides within an allowed directory. This is a textbook instance of CWE-22.

Attack Vector

The vulnerability is reachable over HTTP or HTTPS against any WordPress site with the vulnerable plugin installed. The attacker issues a request to the plugin's file download endpoint and substitutes a relative traversal sequence in the filename parameter. The web server returns the contents of the targeted file under the privileges of the PHP process. No credentials, tokens, or session state are required. See the Patchstack Vulnerability Report for the disclosed advisory.

Detection Methods for CVE-2025-31070

Indicators of Compromise

HTTP requests to plugin endpoints under /wp-content/plugins/lbg-cleverbakery/ containing traversal sequences such as ../, ..%2f, or encoded variants
Requests whose parameters reference sensitive filenames including wp-config.php, .htaccess, or /etc/passwd
Outbound responses from the WordPress host containing recognizable secrets such as DB_PASSWORD or AUTH_KEY patterns

Detection Strategies

Inspect web server access logs for GET or POST requests to lbg-cleverbakery handlers with suspicious path parameters
Deploy WAF rules that block URL-decoded and double-encoded ../ sequences targeting plugin endpoints
Correlate file-read attempts with anomalous response sizes that suggest configuration files were returned

Monitoring Recommendations

Alert on any successful HTTP 200 response from the plugin where the request parameter contained traversal characters
Monitor for repeated probing across the /wp-content/plugins/ namespace from a single source IP
Track integrity of wp-config.php and plugin directories using file-integrity monitoring tooling

How to Mitigate CVE-2025-31070

Immediate Actions Required

Identify all WordPress installations running the lbg-cleverbakery plugin at version 2.5 or earlier
Disable or remove the plugin until a fixed release is installed
Rotate WordPress salts in wp-config.php, database credentials, and any API keys that may have been disclosed
Review web logs for prior exploitation attempts against the affected endpoint

Patch Information

At the time of NVD publication, the advisory tracks affected versions as n/a through <= 2.5. Administrators should consult the Patchstack Vulnerability Report and the LambertGroup vendor channel for the latest fixed release and upgrade guidance.

Workarounds

Block requests to the vulnerable plugin endpoints at the WAF or reverse proxy layer until patched
Restrict the WordPress PHP process with filesystem-level controls so it cannot read wp-config.php or other sensitive files outside the web root
Apply virtual patching rules that reject path parameters containing ../, ..\, or URL-encoded equivalents

bash

# Example NGINX rule to block traversal patterns against the vulnerable plugin
location ~* /wp-content/plugins/lbg-cleverbakery/ {
    if ($args ~* "(\.\./|\.\.%2f|%2e%2e/|%2e%2e%2f)") {
        return 403;
    }
}