CVE-2025-31432: Chop Chop Pop-Up Path Traversal Flaw

CVE-2025-31432 Overview

CVE-2025-31432 is a Local File Inclusion (LFI) vulnerability in the Chop Chop Pop-Up WordPress plugin, also known as Pop-Up Chop Chop. The flaw stems from improper control of filenames passed to PHP include or require statements [CWE-98]. Affected versions include all releases up to and including 2.1.7. An authenticated attacker with low privileges can manipulate include paths to load arbitrary local PHP files on the server. Successful exploitation can lead to information disclosure, code execution through log poisoning, or further compromise of the WordPress host.

Critical Impact
Authenticated attackers can include arbitrary local files through the vulnerable PHP include statement, potentially leading to remote code execution on WordPress sites running Pop-Up Chop Chop 2.1.7 or earlier.

Affected Products

Chop Chop Pop-Up (Pop-Up Chop Chop) WordPress plugin versions through 2.1.7
WordPress sites with the plugin installed and active
Hosting environments allowing PHP file inclusion to local resources

Discovery Timeline

2025-03-28 - CVE-2025-31432 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-31432

Vulnerability Analysis

The vulnerability is classified under [CWE-98]: Improper Control of Filename for Include/Require Statement in PHP Program. The Pop-Up Chop Chop plugin accepts user-controlled input that is concatenated into a PHP include or require call without sufficient validation or path normalization. Although the issue is labeled as PHP Remote File Inclusion in CWE terms, exploitation in practice resolves to Local File Inclusion because typical WordPress hosting disables allow_url_include.

An attacker who controls the include path can traverse the filesystem and load PHP source files, configuration files, or logs interpreted as PHP. Loading attacker-controlled content, such as poisoned access logs or uploaded media, can convert LFI into code execution within the web server process.

Root Cause

The plugin passes request-derived parameters into an include statement without enforcing an allowlist of permitted files. Path traversal sequences such as ../ are not stripped, and absolute paths are not blocked. The vulnerability requires low-privilege authentication, indicating an authenticated user role inside WordPress can reach the affected code path.

Attack Vector

The attack is delivered over the network through HTTP requests to a vulnerable WordPress endpoint exposed by the plugin. The attacker submits crafted parameter values that resolve to sensitive files such as wp-config.php or to attacker-influenced content stored on the server. The CWE-98 mapping and EPSS data indicate active interest in this class of issue, though no public exploit code is currently catalogued for this specific CVE.

Details of the vulnerable parameter and proof-of-concept usage are documented in the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2025-31432

Indicators of Compromise

HTTP requests to Pop-Up Chop Chop plugin endpoints containing path traversal sequences such as ../, ..%2f, or null byte variants
Web server access logs showing parameter values referencing system files such as wp-config.php, /etc/passwd, or /proc/self/environ
Unexpected PHP execution originating from upload directories like wp-content/uploads/
New or modified PHP files in plugin directories following suspicious authenticated requests

Detection Strategies

Inspect WordPress access logs for authenticated requests to plugin endpoints with file path parameters
Monitor PHP include, require, include_once, and require_once calls referencing non-plugin paths during runtime
Correlate low-privilege authenticated sessions with abnormal file access patterns on the web host
Deploy WordPress security plugins or web application firewalls with rules targeting [CWE-98] LFI patterns

Monitoring Recommendations

Enable verbose request logging on WordPress installations exposing the Pop-Up Chop Chop plugin
Alert on any inclusion of sensitive files such as wp-config.php reads from web requests
Watch for PHP process spawning shell utilities like sh, bash, nc, or python from the web server account

How to Mitigate CVE-2025-31432

Immediate Actions Required

Deactivate the Pop-Up Chop Chop plugin until a patched release is verified and installed
Audit WordPress user accounts and revoke unnecessary low-privilege roles that could reach the vulnerable endpoint
Review web server and PHP error logs for evidence of file inclusion attempts dating back to plugin installation
Rotate WordPress secrets, database credentials, and API keys if wp-config.php may have been disclosed

Patch Information

No fixed version was identified in the available advisory data at the time of publication. The vulnerability affects Pop-Up Chop Chop releases through 2.1.7. Consult the Patchstack WordPress Vulnerability Report for current patch status and apply any vendor update as soon as it is released.

Workarounds

Remove or disable the Pop-Up Chop Chop plugin until a vendor patch is available
Place a web application firewall rule blocking path traversal characters in plugin parameters
Set open_basedir in PHP configuration to restrict file access to the WordPress document root
Ensure allow_url_include and allow_url_fopen are disabled in php.ini to limit exploitation impact

bash

# php.ini hardening to limit local file inclusion impact
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"