CVE-2025-46454: Meta Keywords & Description LFI Vulnerability

CVE-2025-46454 Overview

CVE-2025-46454 is a PHP Local File Inclusion (LFI) vulnerability affecting the Meta Keywords & Description WordPress plugin (wp-meta-keywords-meta-description) developed by svil4ok. The vulnerability stems from improper control of filename parameters used in PHP include/require statements, allowing attackers to include arbitrary local files on the server.

Critical Impact

Attackers exploiting this vulnerability could read sensitive configuration files, access WordPress credentials, or potentially achieve remote code execution by including malicious files already present on the target system.

Affected Products

• Meta Keywords & Description WordPress Plugin versions up to and including 0.8
• WordPress installations with the wp-meta-keywords-meta-description plugin active

Discovery Timeline

• 2025-05-23 - CVE-2025-46454 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-46454

Vulnerability Analysis

This vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Meta Keywords & Description plugin fails to properly sanitize user-controlled input before using it in PHP include or require statements. This architectural weakness allows an attacker to manipulate file path parameters to include arbitrary files from the local filesystem.

Local File Inclusion vulnerabilities in WordPress plugins are particularly dangerous because they can expose critical files such as wp-config.php, which contains database credentials and authentication keys. Additionally, if an attacker can upload or otherwise place a malicious PHP file on the server (through other vectors or combined vulnerabilities), LFI can be leveraged to achieve full remote code execution.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization of user-supplied data that is subsequently passed to PHP's file inclusion functions (include, include_once, require, or require_once). The plugin does not implement proper allowlist validation or path canonicalization to prevent directory traversal sequences (such as ../) from being processed.

Attack Vector

An attacker can exploit this vulnerability by crafting malicious requests containing directory traversal sequences to navigate outside the intended directory structure. By manipulating vulnerable parameters, the attacker can force the PHP application to include sensitive local files.

The exploitation typically involves:

1. Identifying vulnerable parameters that accept file paths or names
2. Injecting path traversal sequences (e.g., ../../../) to escape the plugin directory
3. Targeting sensitive files such as /etc/passwd, wp-config.php, or log files
4. Potentially chaining with other vulnerabilities (such as log poisoning) to achieve code execution

For detailed technical information, refer to the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2025-46454

Indicators of Compromise

• Unusual HTTP requests containing path traversal sequences (../, ..%2f, %2e%2e/) targeting the Meta Keywords & Description plugin
• Access log entries showing attempts to include sensitive system files like /etc/passwd or wp-config.php
• Web server error logs indicating file inclusion failures or warnings from the plugin directory
• Unexpected file access patterns in WordPress plugin directories

Detection Strategies

• Deploy Web Application Firewall (WAF) rules to detect and block path traversal patterns in request parameters
• Monitor WordPress access logs for requests to the wp-meta-keywords-meta-description plugin with suspicious query parameters
• Implement file integrity monitoring on critical WordPress configuration files
• Use security plugins that detect LFI attack patterns in real-time

Monitoring Recommendations

• Enable verbose logging for the WordPress installation and review logs for suspicious activity
• Set up alerts for any access to sensitive configuration files from unexpected sources
• Monitor for new or modified files in the WordPress uploads directory that could be used in LFI-to-RCE attacks
• Regularly audit installed WordPress plugins for known vulnerabilities using vulnerability scanning tools

How to Mitigate CVE-2025-46454

Immediate Actions Required

• Deactivate and remove the Meta Keywords & Description plugin (wp-meta-keywords-meta-description) version 0.8 or earlier from all WordPress installations
• Review web server logs for any evidence of exploitation attempts
• Audit WordPress configuration files for unauthorized changes or access
• Consider rotating WordPress authentication keys and database credentials if compromise is suspected

Patch Information

At the time of this advisory, no patch information has been published by the vendor. Users are advised to check the Patchstack WordPress Vulnerability Report for updates and monitor the WordPress plugin repository for a patched version.

Workarounds

• Completely remove or deactivate the vulnerable plugin until a security update is available
• Implement a WAF rule to block requests containing path traversal sequences targeting this plugin
• Use WordPress security plugins that provide virtual patching capabilities
• Restrict file system permissions to limit the impact of potential LFI exploitation

# Example: Remove the vulnerable plugin via WP-CLI
wp plugin deactivate wp-meta-keywords-meta-description --allow-root
wp plugin delete wp-meta-keywords-meta-description --allow-root

# Verify plugin removal
wp plugin list --allow-root | grep meta-keywords