CVE-2025-46474: SEUR Oficial Plugin File Inclusion Flaw

CVE-2025-46474 Overview

CVE-2025-46474 is a PHP Local File Inclusion (LFI) vulnerability in the SEUR Oficial WordPress plugin developed by SEUR OFICIAL. The flaw stems from improper control of filenames used in PHP include/require statements, classified under [CWE-98]. All versions up to and including 2.2.23 are affected. Remote attackers can manipulate file path parameters to load arbitrary local PHP files into the application context, leading to code execution, sensitive data disclosure, or full site compromise. The vulnerability requires no authentication and is exploitable over the network.

Critical Impact
Unauthenticated attackers can include arbitrary local PHP files on WordPress sites running SEUR Oficial <= 2.2.23, enabling code execution and information disclosure.

Affected Products

SEUR OFICIAL SEUR Oficial WordPress plugin versions n/a through <= 2.2.23
WordPress sites with the SEUR Oficial shipping integration installed
Any deployment that has not upgraded beyond version 2.2.23

Discovery Timeline

2025-05-23 - CVE-2025-46474 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-46474

Vulnerability Analysis

The SEUR Oficial plugin passes user-controlled input into a PHP file inclusion statement without sufficient validation or path canonicalization. PHP's include and require constructs evaluate the included file as PHP code, which transforms a path traversal primitive into arbitrary code execution when an attacker can place or reference controllable PHP content on the local filesystem.

The Patchstack advisory categorizes the issue as Local File Inclusion rather than Remote File Inclusion, indicating that allow_url_include is not the exploitation vector. Instead, attackers reference files reachable on the WordPress host, including uploaded media, log files, session files, or temporary files written during request processing. Exploitation has high attack complexity, requiring specific conditions to weaponize the inclusion primitive into reliable code execution.

The EPSS model assigns this vulnerability a probability of 0.547% (percentile 67.93), reflecting moderate predictive likelihood of exploitation activity.

Root Cause

The plugin fails to validate or whitelist the filename parameter before passing it to a PHP file inclusion statement. Missing input sanitization on a path parameter combined with direct concatenation into include/require allows traversal sequences such as ../ and absolute paths to redirect inclusion to attacker-chosen files. See the Patchstack WordPress Vulnerability Report for the technical breakdown.

Attack Vector

An unauthenticated attacker sends an HTTP request to a vulnerable plugin endpoint with a crafted file path parameter. The plugin resolves the path and includes the target file through PHP's inclusion machinery. If the attacker can stage PHP content on disk through plugin uploads, log poisoning, or temporary file primitives, the inclusion executes that code with the privileges of the PHP-FPM or web server worker.

The vulnerability mechanism is described in prose only because no verified proof-of-concept code is publicly available. Refer to the Patchstack advisory linked above for additional context.

Detection Methods for CVE-2025-46474

Indicators of Compromise

HTTP requests to SEUR Oficial plugin endpoints containing path traversal sequences such as ../, ..%2f, or null-byte variants in query or POST parameters
Web server access logs showing plugin URLs referencing files outside the plugin directory, including /etc/passwd, wp-config.php, or /proc/self/environ
PHP error log entries reporting include() or require() warnings for unexpected file paths under wp-content/plugins/seur/
Unexpected outbound connections or new PHP files written under wp-content/uploads/ following plugin activity

Detection Strategies

Audit WordPress plugin inventory and flag any host running SEUR Oficial at version <= 2.2.23
Inspect web application firewall (WAF) telemetry for traversal payloads targeting plugin request handlers
Correlate file integrity monitoring events on wp-content/ with HTTP requests to SEUR Oficial endpoints
Hunt for webshell artifacts and anomalous PHP execution chains spawned from the WordPress process tree

Monitoring Recommendations

Enable verbose PHP error logging and centralize logs for inclusion-related warnings
Monitor outbound network traffic from web servers for command-and-control beaconing originating from PHP workers
Track new file creation under writable WordPress directories and alert on PHP extensions

How to Mitigate CVE-2025-46474

Immediate Actions Required

Upgrade SEUR Oficial to a version higher than 2.2.23 once the vendor publishes a fixed release
Deactivate and remove the plugin from any WordPress installation that does not require shipping integration
Apply WAF rules blocking traversal sequences and absolute paths in parameters sent to SEUR plugin endpoints
Rotate WordPress secrets, database credentials, and API keys on any host suspected of compromise

Patch Information

The vendor patch status is tracked in the Patchstack advisory. Administrators should subscribe to plugin update notifications and apply releases above version 2.2.23 as soon as they are published through the WordPress plugin repository.

Workarounds

Restrict access to the SEUR Oficial plugin endpoints using IP allowlisting at the reverse proxy or WAF
Set open_basedir in PHP configuration to confine inclusion to the WordPress installation directory
Disable the plugin until a patched version is available and validated in staging
Apply virtual patching rules that reject requests containing ../, encoded traversals, or absolute filesystem paths

bash

# Example php.ini hardening to constrain file inclusion
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off