CVE-2025-31405: Fami WooCommerce Compare LFI Vulnerability

CVE-2025-31405 Overview

CVE-2025-31405 is a Local File Inclusion (LFI) vulnerability affecting the Fami WooCommerce Compare WordPress plugin developed by zankover. The vulnerability stems from improper control of filename for include/require statements in PHP, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). This security flaw allows attackers to include local files from the server, potentially exposing sensitive configuration files, credentials, or enabling further exploitation through log poisoning or other techniques.

Critical Impact

Attackers can exploit this LFI vulnerability to read sensitive server files, potentially exposing WordPress configuration credentials, database information, and other critical system data that could lead to complete site compromise.

Affected Products

• Fami WooCommerce Compare plugin versions through 1.0.5
• WordPress installations running vulnerable versions of fami-woocommerce-compare
• WooCommerce-enabled sites utilizing the Fami Compare functionality

Discovery Timeline

• 2025-04-04 - CVE CVE-2025-31405 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-31405

Vulnerability Analysis

This vulnerability exists due to insufficient input validation when the Fami WooCommerce Compare plugin processes file inclusion operations. The plugin fails to properly sanitize user-controlled input that is subsequently used in PHP include or require statements. This allows an attacker to manipulate file paths and include arbitrary local files from the server filesystem.

Local File Inclusion vulnerabilities in WordPress plugins are particularly dangerous because they can provide attackers access to the wp-config.php file, which contains database credentials, authentication keys, and other sensitive configuration data. Additionally, if combined with other techniques such as log poisoning, LFI can potentially escalate to Remote Code Execution.

Root Cause

The root cause of CVE-2025-31405 is the improper handling of user-supplied input within PHP include/require statements. The plugin does not adequately validate or sanitize file path parameters before incorporating them into file inclusion operations. This lack of input validation allows directory traversal sequences (such as ../) to be injected, enabling attackers to navigate outside the intended directory structure and access sensitive files.

Attack Vector

The attack vector involves manipulating HTTP request parameters that are processed by the vulnerable plugin functionality. An attacker can craft malicious requests containing directory traversal sequences to escape the web root and access arbitrary files on the server filesystem.

The exploitation typically involves:

1. Identifying the vulnerable parameter that accepts file path input
2. Injecting directory traversal sequences to navigate to sensitive files
3. Accessing critical files such as /etc/passwd, wp-config.php, or application logs
4. Potentially escalating the attack through log poisoning if write access is available

For detailed technical information about this vulnerability, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-31405

Indicators of Compromise

• Unusual file access patterns in web server logs showing directory traversal sequences (../, ..%2f, etc.)
• HTTP requests targeting the Fami WooCommerce Compare plugin with suspicious path parameters
• Access attempts to sensitive files like wp-config.php, /etc/passwd, or system log files
• Unexpected read operations on configuration files outside the plugin directory

Detection Strategies

• Monitor web application firewall (WAF) logs for directory traversal patterns in requests to /wp-content/plugins/fami-woocommerce-compare/
• Implement file integrity monitoring on critical WordPress configuration files
• Deploy intrusion detection signatures targeting LFI attack patterns
• Review PHP error logs for failed file inclusion attempts indicating exploitation attempts

Monitoring Recommendations

• Enable verbose logging for the WordPress installation and monitor for suspicious file access patterns
• Configure alerting for any access attempts to wp-config.php from non-standard paths
• Implement real-time monitoring of web server access logs for requests containing encoded traversal sequences
• Use endpoint detection solutions to identify unauthorized file read operations

How to Mitigate CVE-2025-31405

Immediate Actions Required

• Update the Fami WooCommerce Compare plugin to a patched version if available from the vendor
• If no patch is available, immediately deactivate and remove the vulnerable plugin from your WordPress installation
• Review web server logs for any signs of prior exploitation attempts
• Rotate all credentials stored in wp-config.php as a precautionary measure

Patch Information

At the time of publication, site administrators should check for updated versions of the Fami WooCommerce Compare plugin through the WordPress plugin repository or the vendor's official channels. The vulnerability affects all versions through 1.0.5. Refer to the Patchstack advisory for the latest patch status and remediation guidance.

Workarounds

• Disable the Fami WooCommerce Compare plugin until a security patch is released
• Implement Web Application Firewall (WAF) rules to block requests containing directory traversal sequences targeting the plugin
• Use .htaccess or nginx configuration to restrict direct access to plugin PHP files
• Apply the principle of least privilege to the web server user to limit file system access

# Example .htaccess rule to block directory traversal attempts
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC,OR]
    RewriteCond %{REQUEST_URI} (\.\./|\.\.\\) [NC]
    RewriteRule .* - [F,L]
</IfModule>