CVE-2025-39396: JetReviews PHP File Inclusion Vulnerability

CVE-2025-39396 Overview

CVE-2025-39396 is a PHP Local File Inclusion (LFI) vulnerability in the Crocoblock JetReviews WordPress plugin. The flaw affects all versions of jet-reviews up to and including 2.3.6. It stems from improper control of a filename used in a PHP include or require statement, tracked as [CWE-98]. An authenticated attacker with low privileges can force the plugin to load arbitrary PHP files present on the server, leading to sensitive information disclosure and potential code execution when combined with file upload primitives.

Critical Impact
Authenticated attackers can include arbitrary local PHP files on WordPress sites running JetReviews <= 2.3.6, compromising confidentiality, integrity, and availability.

Affected Products

Crocoblock JetReviews plugin for WordPress, versions up to and including 2.3.6
WordPress sites with the jet-reviews plugin installed and activated
Deployments where low-privileged accounts can reach the vulnerable plugin endpoints

Discovery Timeline

2025-05-19 - CVE-2025-39396 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39396

Vulnerability Analysis

The JetReviews plugin accepts attacker-influenced input that is passed into a PHP file inclusion statement without proper validation or allow-listing. Because the include path is not restricted to a safe directory, an authenticated user can traverse the filesystem and load PHP files outside the plugin's intended scope. Once included, the file is executed in the context of the WordPress PHP process, exposing configuration data such as wp-config.php secrets, session material, and any code the attacker can plant on the server through log poisoning, uploads, or session files.

Root Cause

The root cause is improper control of a filename passed to a PHP include or require statement ([CWE-98]). The plugin trusts user-supplied input to build a path used in dynamic inclusion, without normalizing the path, restricting it to a whitelisted directory, or enforcing a fixed file extension.

Attack Vector

Exploitation requires network access to the WordPress site and authenticated access with low privileges. The attacker submits a crafted request to the vulnerable JetReviews endpoint containing a path parameter that resolves to an attacker-chosen PHP file on the local filesystem. The higher attack complexity reflects the need for a valid account and, in some scenarios, chaining with a secondary primitive (upload, log poisoning) to achieve arbitrary code execution.

No verified public proof-of-concept code is available. Refer to the Patchstack WordPress Vulnerability Report for advisory details.

Detection Methods for CVE-2025-39396

Indicators of Compromise

HTTP requests to JetReviews endpoints containing path traversal sequences such as ../, encoded variants (%2e%2e%2f), or references to php://filter and php://input wrappers.
Web server access logs showing authenticated users requesting unusual file paths referencing wp-config.php, /etc/passwd, or files under /tmp and /var/log.
Unexpected PHP errors or warnings referencing include() or require() from files inside the jet-reviews plugin directory.

Detection Strategies

Inspect WordPress and web server logs for requests to jet-reviews handlers containing suspicious file path parameters.
Deploy Web Application Firewall (WAF) rules that flag LFI patterns, including directory traversal and PHP stream wrapper usage, against /wp-admin/admin-ajax.php and plugin routes.
Correlate authenticated subscriber or contributor sessions with anomalous file access patterns using SIEM analytics.

Monitoring Recommendations

Monitor changes to plugin files and unexpected reads of wp-config.php at the filesystem level using file integrity monitoring.
Alert on new low-privileged WordPress accounts followed by administrative or plugin-heavy activity.
Track outbound network connections from the PHP-FPM or web server process that deviate from baseline behavior.

How to Mitigate CVE-2025-39396

Immediate Actions Required

Update the JetReviews plugin to a version later than 2.3.6 once released by Crocoblock, or disable the plugin if no patched version is available.
Audit WordPress user accounts and remove or downgrade unused low-privileged accounts that could be leveraged for exploitation.
Review web server and WordPress logs for evidence of prior exploitation attempts against jet-reviews endpoints.

Patch Information

At time of publication, refer to the Patchstack WordPress Vulnerability Report for current patch status. Apply the vendor-supplied update as soon as it becomes available and validate the plugin version in wp-content/plugins/jet-reviews/.

Workarounds

Deploy a WAF rule that blocks path traversal sequences and PHP stream wrappers on requests to JetReviews endpoints.
Restrict PHP open_basedir to the WordPress installation directory to limit which files can be included by the interpreter.
Disable dangerous PHP wrappers by setting allow_url_include = Off and reviewing disable_functions in php.ini.

bash

# Harden PHP configuration to limit LFI impact
# /etc/php/8.x/fpm/php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Restart PHP-FPM to apply
sudo systemctl restart php-fpm