CVE-2025-46444: Ads Pro Plugin LFI Vulnerability

CVE-2025-46444 Overview

CVE-2025-46444 is a Local File Inclusion (LFI) vulnerability affecting the Ads Pro WordPress plugin (ap-plugin-scripteo) developed by scripteo. The vulnerability stems from improper control of filename for include/require statements in the PHP program, allowing attackers to include local files from the server.

This vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). While initially reported as a potential Remote File Inclusion issue, the actual impact is PHP Local File Inclusion, which can lead to sensitive information disclosure, configuration file exposure, and potentially remote code execution if combined with other attack vectors.

Critical Impact

Attackers can exploit this vulnerability to read sensitive files from the server, potentially exposing database credentials, WordPress configuration files, and other sensitive data stored on the web server.

Affected Products

• Ads Pro WordPress Plugin (ap-plugin-scripteo) version 4.88 and earlier
• Ads Pro WordPress Plugin (ap-plugin-scripteo) version 4.89 and earlier
• WordPress installations running vulnerable versions of the Ads Pro plugin

Discovery Timeline

• 2025-05-23 - CVE-2025-46444 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-46444

Vulnerability Analysis

The vulnerability exists in the Ads Pro WordPress plugin due to insufficient validation of user-supplied input that is used in PHP include or require statements. When the plugin processes file paths, it fails to properly sanitize the input, allowing an attacker to manipulate the file path and include arbitrary local files from the server filesystem.

Local File Inclusion vulnerabilities in WordPress plugins are particularly dangerous because attackers can potentially access sensitive files such as wp-config.php, which contains database credentials and authentication keys. Additionally, if an attacker can upload a malicious file (even with a non-executable extension) through another mechanism, they could leverage this LFI to execute that file as PHP code.

Root Cause

The root cause of this vulnerability is the improper control of filename parameters used in PHP include or require statements. The plugin fails to implement proper input validation and path canonicalization, allowing attackers to traverse directory structures or specify arbitrary file paths. Common issues leading to this type of vulnerability include:

• Missing or insufficient input sanitization
• Lack of whitelist-based validation for allowed files
• Failure to use basename() or similar functions to strip directory components
• Not restricting include paths to specific directories

Attack Vector

An attacker can exploit this vulnerability by crafting malicious requests that manipulate file path parameters accepted by the plugin. The attack typically involves directory traversal sequences such as ../ to navigate outside the intended directory and access sensitive files elsewhere on the server.

The vulnerability can be exploited by authenticated or potentially unauthenticated users depending on which plugin functionality exposes the vulnerable code path. Once exploited, attackers can read sensitive configuration files, application source code, and potentially leverage the inclusion for code execution if combined with file upload capabilities or log poisoning techniques.

For detailed technical analysis and exploitation patterns, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-46444

Indicators of Compromise

• Unusual HTTP requests containing directory traversal patterns (../, ..%2f, ..%252f) targeting Ads Pro plugin endpoints
• Web server logs showing attempts to access sensitive files like wp-config.php, /etc/passwd, or log files through plugin parameters
• Unexpected file read operations from the WordPress installation directory
• Error messages in logs indicating failed file inclusion attempts

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block directory traversal patterns in requests to WordPress plugin endpoints
• Monitor web server access logs for requests containing path traversal sequences targeting the ap-plugin-scripteo directory
• Deploy file integrity monitoring to detect unauthorized access to sensitive configuration files
• Configure intrusion detection systems to alert on LFI attack patterns

Monitoring Recommendations

• Enable detailed access logging for your WordPress installation and regularly review logs for suspicious patterns
• Set up real-time alerting for any access attempts to sensitive files like wp-config.php from unexpected sources
• Monitor plugin directories for unusual file access patterns or new file creation
• Implement security information and event management (SIEM) correlation rules for WordPress-specific attacks

How to Mitigate CVE-2025-46444

Immediate Actions Required

• Update the Ads Pro plugin to a patched version beyond 4.89 when available from the vendor
• Review web server access logs for any evidence of exploitation attempts
• Consider temporarily disabling the Ads Pro plugin if a patch is not yet available and the plugin is not critical to operations
• Implement WAF rules to block directory traversal attempts targeting WordPress plugins

Patch Information

Users should monitor the official WordPress plugin repository and the vendor's release channels for security updates addressing this vulnerability. The vulnerability affects Ads Pro versions through 4.89, so ensure you update to a version newer than 4.89 once a patched version is released. For the latest information, consult the Patchstack Vulnerability Report.

Workarounds

• Implement server-level restrictions using .htaccess or nginx configuration to block requests containing directory traversal patterns
• Configure open_basedir PHP directive to restrict file access to the WordPress installation directory
• Deploy a Web Application Firewall with rules specifically targeting LFI and directory traversal attacks
• Restrict file system permissions to limit what files the web server user can read

# Example Apache .htaccess rule to block directory traversal
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC,OR]
RewriteCond %{QUERY_STRING} (\.\.%2f|\.\.%5c) [NC,OR]
RewriteCond %{QUERY_STRING} (\.\.%252f|\.\.%255c) [NC]
RewriteRule .* - [F,L]

# PHP open_basedir restriction in php.ini or .htaccess
# php_admin_value open_basedir /var/www/html/wordpress/