CVE-2025-47571: Super Store Finder Path Traversal Flaw

CVE-2025-47571 Overview

CVE-2025-47571 is a PHP Local File Inclusion (LFI) vulnerability in the superstorefinder-wp plugin developed by highwarden for WordPress. The flaw stems from improper control of filenames in PHP include/require statements [CWE-98]. It affects all Super Store Finder plugin versions up to and including 7.8. Attackers can leverage the issue to read sensitive files from the server or execute attacker-controlled PHP code if writable paths are reachable. The vulnerability requires user interaction over the network, which raises attack complexity but does not eliminate exploitability.

Critical Impact
Successful exploitation allows an unauthenticated attacker to include arbitrary local files on the WordPress host, leading to disclosure of credentials, configuration data, and potential remote code execution.

Affected Products

highwarden Super Store Finder for WordPress (superstorefinder-wp) versions up to and including 7.8
WordPress installations with the plugin enabled
Hosting environments running affected PHP-based plugin code

Discovery Timeline

2025-09-09 - CVE-2025-47571 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-47571

Vulnerability Analysis

The vulnerability is classified as Improper Control of Filename for Include/Require Statement in PHP Program [CWE-98]. The plugin passes user-influenced input into a PHP include or require directive without enforcing an allow-list of safe filenames. This allows path traversal sequences and arbitrary local file references to resolve through the PHP file inclusion mechanism. Although the original CWE category covers Remote File Inclusion, the realized impact in this plugin is Local File Inclusion against the WordPress host. An attacker can target files such as wp-config.php, session storage, or log files. If an attacker can plant PHP content into any readable path, LFI can escalate to code execution under the web server context.

Root Cause

The root cause is missing input validation on a filename parameter consumed by a PHP file inclusion statement inside the superstorefinder-wp plugin. The plugin trusts request-supplied values to construct paths, instead of mapping requests to a fixed dispatch table. Without canonicalization or a strict allow-list, traversal payloads bypass any naive prefix or suffix checks.

Attack Vector

Exploitation occurs over the network and requires user interaction, typically clicking a crafted link that triggers the vulnerable plugin endpoint. The attacker submits a request containing a manipulated filename parameter that resolves through include/require to a sensitive PHP or text file on the server. See the Patchstack Vulnerability Report for technical details.

No verified public proof-of-concept code is available at this time.

Detection Methods for CVE-2025-47571

Indicators of Compromise

HTTP requests to plugin endpoints under /wp-content/plugins/superstorefinder-wp/ containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f
Web server access log entries referencing sensitive files including wp-config.php, /etc/passwd, or PHP session files via query parameters
Unexpected outbound network connections initiated by the PHP-FPM or web server worker processes after suspicious requests

Detection Strategies

Inspect WordPress and web server logs for requests targeting superstorefinder-wp PHP files with filename or path parameters containing directory traversal patterns
Deploy WAF rules that block URL parameters resolving to php://, file://, or relative path sequences targeting plugin scripts
Correlate file-read system calls from the web server user against the list of expected plugin assets

Monitoring Recommendations

Alert on access attempts to wp-config.php or .env files from the web server process outside of normal application flow
Monitor for new or modified PHP files in upload directories that could serve as LFI payload sources
Track plugin version inventory across WordPress sites to flag installations still running Super Store Finder 7.8 or earlier

How to Mitigate CVE-2025-47571

Immediate Actions Required

Disable or remove the Super Store Finder plugin until a patched version above 7.8 is confirmed installed
Audit web server logs for prior exploitation attempts against plugin endpoints
Rotate any secrets stored in wp-config.php, including database credentials and authentication keys, if compromise is suspected

Patch Information

The vendor advisory tracked through the Patchstack Vulnerability Report indicates the flaw affects versions through 7.8. Administrators should upgrade to the latest available release from the plugin maintainer and verify version metadata after deployment.

Workarounds

Restrict access to plugin PHP entry points using web server rules until patching is complete
Apply WAF signatures that block path traversal and PHP wrapper schemes on requests targeting the plugin directory
Run PHP with open_basedir restricted to the WordPress root to limit the filesystem reachable by include/require

bash

# Example: restrict PHP file access via open_basedir in php.ini or vhost
php_admin_value[open_basedir] = "/var/www/html/:/tmp/"

# Example: nginx rule to block traversal on the plugin path
location ~* /wp-content/plugins/superstorefinder-wp/.*\.php$ {
    if ($args ~* "\.\./|%2e%2e|php://|file://") {
        return 403;
    }
}