CVE-2025-31635: CLEVER lbg-audio11 Path Traversal Flaw

CVE-2025-31635 Overview

CVE-2025-31635 is a path traversal vulnerability in the LambertGroup CLEVER lbg-audio11-html5-shoutcast_history WordPress plugin. The flaw affects all versions up to and including 2.6. Unauthenticated attackers can craft requests that traverse outside the intended directory and download arbitrary files from the server. The vulnerability is categorized under CWE-22 and is exploitable over the network without authentication or user interaction.

Critical Impact
Remote unauthenticated attackers can read arbitrary files from the WordPress host, including configuration files containing database credentials and secret keys.

Affected Products

LambertGroup CLEVER (lbg-audio11-html5-shoutcast_history) WordPress plugin
All versions from initial release through 2.6
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-06-09 - CVE-2025-31635 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2025-31635

Vulnerability Analysis

The CLEVER plugin fails to properly sanitize user-supplied file path parameters before passing them to file read or download operations. Attackers can supply directory traversal sequences such as ../ to escape the plugin's intended file scope. The result is an arbitrary file download primitive that exposes any file readable by the web server process.

The vulnerability requires no authentication and no user interaction. An attacker only needs network access to the WordPress site and knowledge of the vulnerable endpoint exposed by the plugin. The Patchstack advisory classifies this as an arbitrary file download issue, which directly enables credential and secret theft.

Root Cause

The root cause is improper limitation of a pathname to a restricted directory [CWE-22]. The plugin accepts a file path or filename from request input and concatenates it into a filesystem path used by a download handler. The handler does not normalize the path, reject traversal sequences, or constrain reads to an allow-listed directory.

Attack Vector

An attacker sends an HTTP request to the vulnerable plugin endpoint with a manipulated path parameter. The parameter contains ../ sequences that walk up the filesystem to reach sensitive targets such as wp-config.php, /etc/passwd, or backup archives. The server responds with the file contents. With WordPress database credentials and authentication keys extracted from wp-config.php, attackers can pivot to full site compromise.

See the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-31635

Indicators of Compromise

HTTP requests to plugin endpoints containing ../, ..%2f, or URL-encoded traversal sequences in query parameters
Web server access logs showing requests targeting wp-config.php, /etc/passwd, or other sensitive files via plugin URLs
Unexpected outbound activity following requests to the lbg-audio11-html5-shoutcast_history plugin path
File download responses with content types inconsistent with audio or media files

Detection Strategies

Inspect web server and WAF logs for traversal patterns directed at /wp-content/plugins/lbg-audio11-html5-shoutcast_history/ URIs
Alert on HTTP 200 responses returning PHP source or system file content from plugin endpoints
Correlate file access patterns with WordPress plugin telemetry to identify abnormal reads
Hunt for repeated 4xx and 5xx responses to plugin endpoints that indicate enumeration attempts

Monitoring Recommendations

Enable WordPress access logging at the reverse proxy and route logs to a central SIEM for retention and search
Monitor filesystem access to wp-config.php and other sensitive files using host-based file integrity monitoring
Track plugin version inventory across WordPress estates to identify unpatched CLEVER installations

How to Mitigate CVE-2025-31635

Immediate Actions Required

Disable or uninstall the LambertGroup CLEVER plugin until a patched version is confirmed available from the vendor
Rotate WordPress database credentials, AUTH_KEY, SECURE_AUTH_KEY, LOGGED_IN_KEY, and NONCE_KEY values defined in wp-config.php
Review web server access logs for traversal patterns and treat any successful arbitrary file download as a confirmed breach
Restrict access to WordPress admin and plugin endpoints behind a web application firewall with traversal rules

Patch Information

At the time of NVD publication, the advisory states the issue affects CLEVER versions up to and including 2.6. Review the Patchstack Vulnerability Report for the latest vendor patch status and upgrade guidance.

Workarounds

Block requests containing ../, ..%2f, ..%5c, and other URL-encoded traversal sequences at the WAF or reverse proxy
Apply virtual patching rules at the WAF to deny direct requests to the vulnerable plugin's PHP handlers
Restrict the web server user's filesystem permissions so it cannot read sensitive files outside the WordPress document root

bash

# Example ModSecurity rule to block path traversal against the vulnerable plugin
SecRule REQUEST_URI "@contains /wp-content/plugins/lbg-audio11-html5-shoutcast_history/" \
    "chain,id:1003163,phase:2,deny,status:403,msg:'CVE-2025-31635 path traversal attempt'"
    SecRule ARGS "@rx (\.\.[\\/]|%2e%2e[\\/]|\.\.%2f|\.\.%5c)" "t:lowercase,t:urlDecodeUni"