CVE-2025-39570: WPCOM Member Path Traversal Vulnerability

CVE-2025-39570 Overview

CVE-2025-39570 is a Local File Inclusion (LFI) vulnerability in the Lomu WPCOM Member plugin for WordPress. The flaw stems from improper control of filenames passed to PHP include or require statements, classified as [CWE-98]. Authenticated attackers can leverage the vulnerability to include arbitrary local files within the PHP execution context. The issue affects WPCOM Member versions up to and including 1.7.7.

Successful exploitation can lead to sensitive file disclosure, configuration leakage, and remote code execution when combined with file upload primitives. The vulnerability requires low-privileged authentication and can be triggered over the network with low attack complexity.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, leading to information disclosure and potential remote code execution on affected WordPress sites.

Affected Products

Lomu WPCOM Member plugin for WordPress
WPCOM Member versions from n/a through 1.7.7
WordPress installations using the vulnerable wpcom-member plugin

Discovery Timeline

2025-04-16 - CVE-2025-39570 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-39570

Vulnerability Analysis

The vulnerability resides in the WPCOM Member plugin's handling of user-controllable input passed to PHP file inclusion functions. The plugin fails to sanitize or validate filename parameters before passing them to include, include_once, require, or require_once statements. This allows attackers to manipulate the inclusion path and load arbitrary PHP files from the local filesystem.

The classification as [CWE-98] (Improper Control of Filename for Include/Require Statement) places this in the PHP Remote File Inclusion category. However, the practical impact in this case is Local File Inclusion, where attackers reference files already present on the server.

Root Cause

The root cause is missing input validation on a parameter used to construct a file path argument for a PHP inclusion directive. When user-supplied data flows directly into include or require without normalization, path traversal sequences such as ../ enable navigation outside the intended directory. The plugin does not apply allowlist validation, file extension restrictions, or canonicalization checks before file inclusion.

Attack Vector

An authenticated attacker with low privileges sends a crafted HTTP request to a vulnerable endpoint in the WPCOM Member plugin. The request contains a manipulated filename parameter that traverses the filesystem to reference a target PHP file. The server executes the included file within the WordPress application context.

Attack scenarios include reading wp-config.php for database credentials, including session files containing serialized PHP objects, or chaining with arbitrary file upload weaknesses to achieve remote code execution. See the Patchstack WordPress Vulnerability advisory for additional context.

Detection Methods for CVE-2025-39570

Indicators of Compromise

HTTP requests to WPCOM Member plugin endpoints containing path traversal sequences such as ../ or URL-encoded variants like %2e%2e%2f
Web server access logs showing parameter values referencing sensitive files like wp-config.php, /etc/passwd, or PHP session files
Unexpected PHP file inclusions originating from the wp-content/plugins/wpcom-member/ directory tree
Authenticated user sessions making repeated requests with varying file path parameters

Detection Strategies

Inspect web application firewall (WAF) logs for path traversal patterns targeting WordPress plugin endpoints
Monitor PHP error logs for include or require warnings referencing non-standard paths
Audit installed WordPress plugins and flag any wpcom-member installation at version 1.7.7 or earlier
Correlate authenticated WordPress sessions with anomalous file access patterns in PHP-FPM or Apache logs

Monitoring Recommendations

Enable verbose logging on the WordPress application and forward logs to a centralized SIEM for analysis
Set alerts on file read operations targeting wp-config.php outside of expected WordPress core processes
Track outbound HTTP requests from the web server that may indicate post-exploitation data exfiltration
Baseline normal request patterns to WPCOM Member endpoints and flag deviations

How to Mitigate CVE-2025-39570

Immediate Actions Required

Identify all WordPress installations running the WPCOM Member plugin at version 1.7.7 or earlier
Upgrade WPCOM Member to a patched version once released by the vendor
Deactivate and remove the WPCOM Member plugin if a patch is not yet available and the functionality is non-essential
Rotate WordPress administrator credentials, database passwords, and API keys if exploitation is suspected

Patch Information

At the time of publication, the vendor advisory tracked by Patchstack identifies all versions through 1.7.7 as affected. Administrators should consult the Patchstack WordPress Vulnerability advisory for the latest patch availability and update the plugin through the WordPress admin dashboard.

Workarounds

Deploy a web application firewall rule blocking path traversal sequences in requests to wp-content/plugins/wpcom-member/ paths
Restrict authenticated user registration on WordPress sites to reduce the pool of accounts that can reach the vulnerable code path
Apply filesystem permissions limiting the web server user's read access to sensitive files such as wp-config.php
Enable PHP open_basedir restrictions to constrain file inclusion to specific directories

bash

# Example PHP open_basedir restriction in php.ini
open_basedir = "/var/www/html/:/tmp/"

# Example WAF rule snippet (ModSecurity) blocking traversal in plugin requests
SecRule REQUEST_URI "@contains wpcom-member" \
  "chain,deny,status:403,id:1003957,msg:'CVE-2025-39570 LFI attempt'"
SecRule ARGS "@rx (\.\./|%2e%2e%2f)" "t:none,t:lowercase"