CVE-2025-47496: PublishPress Authors LFI Vulnerability

CVE-2025-47496 Overview

CVE-2025-47496 is a Local File Inclusion (LFI) vulnerability in the PublishPress Authors WordPress plugin. The flaw affects all versions up to and including 4.7.5. It stems from improper control of filenames used in PHP include or require statements, classified as [CWE-98].

Authenticated attackers with low-privilege access can manipulate file path parameters to load arbitrary local PHP files. Successful exploitation can lead to sensitive information disclosure, code execution through log poisoning, or full site compromise when combined with file upload primitives.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, exposing credentials, configuration data, and enabling remote code execution paths on affected WordPress sites.

Affected Products

PublishPress Authors plugin for WordPress
All versions from initial release through 4.7.5
WordPress sites with the publishpress-authors plugin installed and activated

Discovery Timeline

2025-05-07 - CVE-2025-47496 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-47496

Vulnerability Analysis

The vulnerability resides in the PublishPress Authors plugin's handling of user-controlled input passed to PHP file inclusion functions. The plugin fails to properly validate or sanitize filename parameters before they reach include, require, include_once, or require_once statements.

This class of flaw [CWE-98] is commonly described as PHP Remote File Inclusion, but in this case the exploitation path is limited to local files on the server. Attackers can traverse the filesystem using path manipulation sequences to load PHP files outside the intended directory scope.

The attack requires authentication with low privileges, reducing the attacker pool but remaining accessible to any registered contributor or subscriber account. The EPSS data places exploitation likelihood at the higher end of the percentile distribution for unexploited flaws.

Root Cause

The root cause is missing input validation on a file path parameter used in a dynamic PHP inclusion statement. The plugin constructs include paths from request data without enforcing an allowlist of permitted files or stripping directory traversal sequences such as ../.

When PHP resolves the include statement, it follows the attacker-supplied path and executes any resulting PHP file with the privileges of the web server process. Refer to the Patchstack advisory for further technical context.

Attack Vector

The attack vector is network-based and requires an authenticated session on the target WordPress instance. An attacker submits a crafted HTTP request to a vulnerable plugin endpoint with a manipulated file path parameter.

The server interprets the path and includes the targeted PHP file. Attackers commonly chain this with log file poisoning, session file inclusion, or phar:// wrappers to escalate from file disclosure to remote code execution.

The vulnerability manifests in the plugin's request handling logic where user-supplied input flows into PHP file inclusion functions. See the security advisory for technical details.

Detection Methods for CVE-2025-47496

Indicators of Compromise

HTTP requests to PublishPress Authors plugin endpoints containing ../ sequences or absolute filesystem paths
Web server access logs showing PHP errors referencing unexpected included file paths
Unexpected PHP processes spawning shell commands or outbound network connections from the web server
Newly created or modified PHP files within the WordPress wp-content directory

Detection Strategies

Inspect WordPress and web server logs for query strings or POST bodies containing directory traversal patterns targeting publishpress-authors endpoints
Deploy Web Application Firewall (WAF) rules that block path traversal patterns and known LFI payloads against WordPress administrative routes
Monitor for authenticated low-privilege accounts making unusual requests to plugin handler scripts
Correlate authentication events with subsequent file inclusion attempts to identify compromised accounts

Monitoring Recommendations

Enable verbose PHP error logging and forward logs to a centralized SIEM for retention and correlation
Track filesystem integrity for the WordPress installation directory and alert on unauthorized changes to PHP files
Monitor outbound network connections originating from the PHP-FPM or web server process for command-and-control indicators
Audit WordPress user accounts and remove inactive or unnecessary low-privilege users that could be leveraged for authenticated attacks

How to Mitigate CVE-2025-47496

Immediate Actions Required

Update the PublishPress Authors plugin to a version above 4.7.5 once the vendor publishes a patched release
Audit existing WordPress user accounts and disable any unused contributor, author, or subscriber accounts
Review web server and PHP error logs for evidence of prior exploitation attempts targeting plugin endpoints
Rotate WordPress credentials, API keys, and database passwords if exploitation indicators are present

Patch Information

Monitor the Patchstack advisory and the official WordPress plugin repository for an updated release addressing CVE-2025-47496. Apply the patch immediately upon availability and verify the installed version through the WordPress admin dashboard.

Workarounds

Deactivate and remove the PublishPress Authors plugin until a patched version is available if it is not business-critical
Restrict access to WordPress administrative and plugin endpoints by source IP address using web server or WAF rules
Configure PHP open_basedir restrictions to limit file inclusion to the WordPress installation directory tree
Enforce strong authentication and multi-factor authentication for all WordPress user accounts to reduce the authenticated attack surface

bash

# Example PHP open_basedir hardening in php.ini
open_basedir = "/var/www/html/wordpress/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
allow_url_include = Off
allow_url_fopen = Off