CVE-2025-39399: License For Envato RCE Vulnerability

CVE-2025-39399 Overview

CVE-2025-39399 is a PHP Local File Inclusion (LFI) vulnerability in the Ashraful Sarkar Naiem License For Envato WordPress plugin (license-envato). The flaw stems from improper control of filenames used in PHP include or require statements [CWE-98]. All plugin versions up to and including 1.0.0 are affected. An attacker can coerce the application into including arbitrary local PHP files, leading to information disclosure, configuration leakage, or code execution when combined with file upload primitives.

Critical Impact

Successful exploitation allows attackers to include and execute arbitrary PHP files on the host, compromising confidentiality, integrity, and availability of the WordPress site.

Affected Products

• Ashraful Sarkar Naiem License For Envato plugin (license-envato)
• Versions: from n/a through <= 1.0.0
• WordPress installations with the plugin enabled

Discovery Timeline

• 2025-04-24 - CVE-2025-39399 published to the National Vulnerability Database (NVD)
• 2026-04-23 - Last updated in the NVD database

Technical Details for CVE-2025-39399

Vulnerability Analysis

The vulnerability is classified under [CWE-98]: Improper Control of Filename for Include/Require Statement in PHP Program. The license-envato plugin passes user-controllable input into a PHP include, require, include_once, or require_once statement without adequate validation or path normalization. As a result, an attacker who can influence the filename parameter can traverse the filesystem and force the PHP interpreter to load files outside the intended directory. The Patchstack advisory characterizes the issue as a Local File Inclusion. Successful exploitation requires user interaction, which slightly raises the attack complexity, but the path remains network-reachable through standard HTTP requests.

Root Cause

The root cause is missing input sanitization on a parameter that resolves to a file path consumed by a PHP include statement. The plugin does not enforce an allowlist of permitted files, does not strip directory traversal sequences such as ../, and does not constrain inclusion to a fixed base directory using functions like realpath() combined with prefix validation.

Attack Vector

The attack vector is network-based. An attacker crafts a request containing a manipulated filename parameter and induces an authenticated or interacting user to trigger the vulnerable endpoint. When the request is processed, PHP includes the attacker-specified file. If the attacker can place PHP content into a readable location on the server, such as an uploaded image, a log file, or a session file, inclusion converts the LFI into remote code execution.

No public proof-of-concept exploit was referenced in the available data. For technical details, see the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-39399

Indicators of Compromise

• HTTP requests to license-envato plugin endpoints containing path traversal patterns such as ../, ..%2f, or absolute filesystem paths
• Requests with parameters referencing sensitive files like /etc/passwd, wp-config.php, or PHP session files
• Unexpected PHP execution originating from upload directories, /tmp, or web server log paths

Detection Strategies

• Review web server and WordPress access logs for requests targeting plugin scripts under wp-content/plugins/license-envato/ with suspicious filename parameters
• Deploy Web Application Firewall (WAF) rules that flag traversal sequences and null-byte injection in query strings and POST bodies
• Monitor PHP include/require execution against unexpected file paths using runtime application self-protection (RASP) where available

Monitoring Recommendations

• Alert on new PHP processes spawned from web-writable directories such as wp-content/uploads/
• Track file integrity changes within the plugin directory and the broader WordPress installation
• Correlate authentication events with anomalous plugin endpoint access to identify forced-interaction exploitation

How to Mitigate CVE-2025-39399

Immediate Actions Required

• Disable and remove the License For Envato plugin until a patched release is available
• Audit WordPress sites for the presence of license-envato version 1.0.0 or earlier
• Restrict access to the WordPress administration interface using IP allowlists and multi-factor authentication
• Inspect wp-content/uploads/ and other writable paths for unauthorized PHP files

Patch Information

No fixed version is identified in the available advisory data. The plugin is reported as vulnerable through <= 1.0.0. Administrators should consult the Patchstack Vulnerability Report for any vendor-supplied update and remove the plugin if no patch is published.

Workarounds

• Block requests to wp-content/plugins/license-envato/ at the reverse proxy or WAF until removal is complete
• Set open_basedir in php.ini to confine PHP file access to the WordPress document root
• Disable PHP execution in wp-content/uploads/ using web server configuration to prevent LFI-to-RCE pivoting

# Example nginx hardening to block PHP execution in uploads
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}

# Example php.ini hardening
# open_basedir = "/var/www/html:/tmp"
# allow_url_include = Off