CVE-2025-47498: Hotel Booking nd-booking LFI Vulnerability

CVE-2025-47498 Overview

CVE-2025-47498 is a PHP Local File Inclusion (LFI) vulnerability in the nicdark Hotel Booking (nd-booking) WordPress plugin. The flaw stems from improper control of filenames used in PHP include or require statements [CWE-98]. Authenticated attackers with low privileges can supply manipulated input that causes the plugin to include arbitrary local files. The vulnerability affects all versions of Hotel Booking up to and including 3.6. Exploitation can disclose sensitive server-side files, expose credentials, and in some configurations lead to code execution through log poisoning or session file abuse.

Critical Impact
Authenticated attackers can read arbitrary local files and potentially execute PHP code through inclusion of attacker-controlled content on WordPress sites running Hotel Booking ≤ 3.6.

Affected Products

nicdark Hotel Booking (nd-booking) WordPress plugin, versions up to and including 3.6
WordPress installations with the nd-booking plugin enabled
Hosting environments running PHP with the vulnerable plugin active

Discovery Timeline

2025-05-07 - CVE-2025-47498 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-47498

Vulnerability Analysis

The Hotel Booking plugin passes user-controllable input into a PHP include or require statement without sufficient sanitization or allow-list validation. This pattern is classified under [CWE-98], Improper Control of Filename for Include/Require Statement in PHP Program. Because the included path is influenced by request data, an attacker can traverse the filesystem and load files outside the intended directory. While the advisory categorizes the issue as Local File Inclusion, the underlying weakness class (PHP RFI/LFI) can escalate to remote code execution when an attacker chains it with uploaded content, log files, or session storage. Exploitation requires authentication, which raises the attack complexity but does not eliminate risk on multi-author or customer-facing WordPress sites.

Root Cause

The root cause is direct use of attacker-influenced parameters within a dynamic file inclusion call. The plugin does not enforce a strict allow-list of permitted files, does not normalize path separators, and does not reject traversal sequences such as ../. As a result, the PHP engine resolves the supplied path and includes whichever file is reachable on disk.

Attack Vector

The attack is delivered over the network against a vulnerable WordPress endpoint exposed by the nd-booking plugin. An authenticated user submits a request containing a manipulated parameter that controls the include target. The PHP interpreter executes the contents of the resolved file in the context of the web server process, potentially exposing wp-config.php credentials, secret keys, and other sensitive material.

No verified proof-of-concept code is published. Refer to the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-47498

Indicators of Compromise

HTTP requests to nd-booking plugin endpoints containing path traversal sequences such as ../, ..%2f, or encoded null bytes
Web server access logs showing parameter values referencing system files like /etc/passwd, wp-config.php, or proc/self/environ
Unexpected PHP errors referencing include(), require(), or failed to open stream originating from the nd-booking plugin directory
Outbound connections or new files written by the web server user shortly after suspicious plugin requests

Detection Strategies

Inspect web application firewall (WAF) and reverse proxy logs for traversal payloads targeting wp-content/plugins/nd-booking/
Correlate authenticated WordPress session activity with anomalous file read patterns on the underlying host
Hunt for PHP processes spawning shell utilities (sh, bash, curl, wget) under the web server account
Use file integrity monitoring on wp-config.php and other sensitive files to detect unauthorized access attempts

Monitoring Recommendations

Forward web server, PHP-FPM, and WordPress audit logs to a centralized analytics platform for retention and correlation
Alert on repeated 200-status responses to plugin endpoints where parameters contain encoded path characters
Track the inventory of installed WordPress plugins and their versions to flag vulnerable instances of nd-booking
Monitor for new low-privilege account registrations followed by access to plugin endpoints

How to Mitigate CVE-2025-47498

Immediate Actions Required

Identify all WordPress sites running the nd-booking plugin and confirm the installed version
Deactivate and remove Hotel Booking 3.6 and earlier until a fixed release is applied
Rotate WordPress secret keys, database credentials, and any API tokens stored in wp-config.php if exploitation is suspected
Audit user accounts and remove unused low-privilege accounts that could be abused for authenticated exploitation

Patch Information

At the time of publication, the advisory lists versions through 3.6 as affected. Consult the Patchstack Vulnerability Report and the plugin vendor for an updated release. Apply the vendor-supplied patch as soon as it becomes available.

Workarounds

Restrict access to WordPress authenticated endpoints using IP allow-listing or VPN where feasible
Deploy WAF rules that block path traversal sequences and absolute paths in parameters submitted to nd-booking endpoints
Configure PHP open_basedir to limit which directories the web server process can read
Disable the plugin entirely on sites that do not require hotel booking functionality

bash

# Example php.ini hardening to constrain file inclusion scope
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off