CVE-2025-46230: Popup Builder Local File Inclusion Flaw

CVE-2025-46230 Overview

CVE-2025-46230 is a PHP Local File Inclusion (LFI) vulnerability in the GhozyLab Popup Builder plugin (easy-notify-lite) for WordPress. The flaw stems from improper control of filenames used in PHP include or require statements, classified under [CWE-98]. Authenticated attackers with low privileges can manipulate file path parameters to include arbitrary local PHP files on the server. Successful exploitation can lead to source code disclosure, configuration leaks, and execution of attacker-controlled code if files can be planted on the filesystem. The vulnerability affects all versions of Popup Builder up to and including 1.1.35.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, potentially leading to remote code execution and full compromise of the WordPress site.

Affected Products

GhozyLab Popup Builder (easy-notify-lite) WordPress plugin
All versions from n/a through 1.1.35
WordPress sites with the vulnerable plugin installed and active

Discovery Timeline

2025-04-24 - CVE-2025-46230 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-46230

Vulnerability Analysis

The vulnerability exists in how the Popup Builder plugin handles file paths passed to PHP include or require statements. The plugin fails to validate or sanitize user-supplied input before using it to construct a file path. This allows an authenticated attacker to traverse directories and load arbitrary PHP files from the local filesystem.

When an attacker loads a PHP file through the inclusion sink, the PHP interpreter executes its contents in the context of the WordPress process. Loading log files, uploaded media, or session files containing attacker-controlled PHP code can escalate the LFI to remote code execution. Sensitive files such as wp-config.php may also be disclosed, exposing database credentials and authentication keys.

Root Cause

The root cause is improper control of filenames used in PHP include/require statements [CWE-98]. The plugin accepts a parameter that influences a file path without enforcing an allowlist, normalizing the path, or restricting inclusion to a known safe directory. This pattern is commonly referred to as PHP Remote File Inclusion, though in this case exploitation is bound to local files based on PHP configuration defaults.

Attack Vector

Exploitation requires network access to the WordPress site and an authenticated session with low privileges. The attacker crafts a request to a plugin endpoint that passes a manipulated filename parameter. The parameter uses path traversal sequences or absolute paths to reference a target PHP file. The PHP runtime then includes and executes that file. Refer to the Patchstack WordPress Vulnerability advisory for parameter-level details.

Detection Methods for CVE-2025-46230

Indicators of Compromise

HTTP requests to Popup Builder plugin endpoints containing path traversal sequences such as ../ or absolute paths in query parameters or POST body
Unexpected access to sensitive files like wp-config.php, /etc/passwd, or PHP session files originating from the web server process
Unusual PHP processes spawning shells, network connections, or file writes following requests to the plugin
New or modified PHP files in the WordPress uploads or plugin directories

Detection Strategies

Monitor WordPress access logs for requests targeting easy-notify-lite plugin paths with suspicious filename parameters
Apply web application firewall (WAF) rules that flag traversal patterns and absolute file paths in plugin request parameters
Inspect PHP error logs for include/require warnings referencing unexpected file paths
Correlate authenticated user activity with file inclusion attempts to identify compromised low-privilege accounts

Monitoring Recommendations

Enable verbose logging on the WordPress site, including request parameters and authenticated user IDs
Forward web server and PHP logs to a centralized analytics platform for retention and search
Alert on file integrity changes within wp-content/plugins/easy-notify-lite/ and the WordPress uploads directory
Track outbound network connections from the PHP-FPM or web server process to detect post-exploitation activity

How to Mitigate CVE-2025-46230

Immediate Actions Required

Deactivate and remove the Popup Builder (easy-notify-lite) plugin until a patched version is available
Audit WordPress user accounts and revoke any unnecessary low-privilege access that could be abused for exploitation
Rotate WordPress secrets in wp-config.php and database credentials if the site shows signs of inclusion attempts
Review file integrity of the WordPress installation and remove any unauthorized PHP files

Patch Information

At the time of publication, no fixed version beyond 1.1.35 is referenced in the advisory. Site operators should monitor the Patchstack WordPress Vulnerability advisory and the plugin's repository for an updated release that addresses CWE-98.

Workarounds

Block requests to vulnerable plugin endpoints at the WAF or reverse proxy layer using rules that reject path traversal characters
Restrict PHP open_basedir to the WordPress installation directory to limit which files the PHP process can include
Set allow_url_include = Off and allow_url_fopen = Off in php.ini to prevent remote inclusion vectors
Apply principle-of-least-privilege to the WordPress filesystem so the web server user cannot read sensitive system files

bash

# Configuration example - php.ini hardening
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html/wordpress:/tmp"
disable_functions = exec,passthru,shell_exec,system,proc_open,popen