CVE-2025-47653 Overview
CVE-2025-47653 is a Local File Inclusion (LFI) vulnerability in the WP-Recall WordPress plugin by tggfref. The flaw stems from improper control of filenames passed to PHP include or require statements [CWE-98]. Authenticated attackers can abuse user-controlled input to include arbitrary PHP files from the server filesystem. Successful exploitation can lead to sensitive information disclosure, execution of attacker-staged PHP code, and full compromise of the WordPress site. The vulnerability affects all WP-Recall versions up to and including 16.26.14.
Critical Impact
Authenticated attackers can include arbitrary local PHP files, enabling code execution within the WordPress process and full site compromise.
Affected Products
- WP-Recall WordPress plugin by tggfref
- All versions from initial release through 16.26.14
- WordPress sites with the plugin installed and active
Discovery Timeline
- 2025-05-07 - CVE-2025-47653 published to the National Vulnerability Database
- 2026-04-28 - Last updated in NVD database
Technical Details for CVE-2025-47653
Vulnerability Analysis
The vulnerability is classified as Improper Control of Filename for Include/Require Statement in PHP Program [CWE-98]. WP-Recall passes attacker-influenced input into a PHP file inclusion sink without sufficient validation or path normalization. While the original CWE label references PHP Remote File Inclusion, the confirmed impact in this advisory is Local File Inclusion. An attacker with low-privileged authenticated access can manipulate the parameter to traverse the filesystem and load arbitrary .php files accessible to the web server user. Any included file that contains PHP code is executed in the context of the WordPress process.
Root Cause
The plugin constructs a path used in an include, require, include_once, or require_once call from request data without enforcing an allowlist of expected modules. Missing checks for directory traversal sequences, absolute paths, and file extensions allow the attacker to point the inclusion at unintended files on the server.
Attack Vector
Exploitation occurs over the network against the WordPress HTTP interface. The attacker requires low-privilege authenticated access to reach the vulnerable endpoint. By supplying a crafted value to the affected parameter, the attacker forces the plugin to include a chosen file. Combined with primitives that drop attacker-controlled PHP content on disk, such as log poisoning, session files, or uploaded media, the inclusion can be escalated to remote code execution.
No verified public proof-of-concept code is available for this issue. Refer to the Patchstack Local File Inclusion Advisory for additional technical context.
Detection Methods for CVE-2025-47653
Indicators of Compromise
- HTTP requests to WP-Recall endpoints containing path traversal sequences such as ../, encoded variants like %2e%2e%2f, or null byte markers in parameter values.
- Requests where plugin parameters reference absolute paths or non-plugin files ending in .php, .log, .ini, or session file paths under /tmp or /var/lib/php/sessions.
- Unexpected PHP errors in web server logs referencing include(), require(), or failed to open stream originating from files under wp-content/plugins/wp-recall/.
Detection Strategies
- Inspect web server and WordPress access logs for authenticated requests to WP-Recall URLs containing directory traversal patterns or unusual file path parameters.
- Deploy WAF rules that block traversal sequences and absolute paths in query parameters and POST bodies targeted at the plugin.
- Monitor PHP error logs for include/require warnings originating from the WP-Recall plugin directory.
Monitoring Recommendations
- Alert on new PHP files written under wp-content/uploads/ or other web-writable directories followed by inclusion attempts.
- Track authentication events that precede anomalous parameter activity on plugin endpoints, particularly low-privilege accounts performing administrative-shaped actions.
- Forward WordPress, PHP, and web server logs to a centralized analytics platform and correlate inclusion errors with subsequent process or file system activity.
How to Mitigate CVE-2025-47653
Immediate Actions Required
- Update WP-Recall to a version newer than 16.26.14 once the vendor publishes a fixed release.
- If no patched version is available, deactivate and remove the WP-Recall plugin from affected WordPress sites.
- Audit user accounts and revoke any unexpected privilege escalations or sessions created since the vulnerable plugin was deployed.
- Review web server, plugin upload, and log directories for unauthorized .php artifacts.
Patch Information
The vendor advisory tracked by Patchstack identifies all WP-Recall versions through 16.26.14 as vulnerable. Site administrators should consult the Patchstack Local File Inclusion Advisory and the WP-Recall plugin page in the WordPress.org repository for the current fixed release.
Workarounds
- Restrict access to WP-Recall endpoints with a web application firewall rule blocking traversal characters and absolute paths in parameter values.
- Configure PHP open_basedir to constrain file inclusion to the WordPress installation directory, limiting the reachable filesystem.
- Set allow_url_include = Off and allow_url_fopen = Off in php.ini to reduce the impact of related inclusion abuse vectors.
- Apply least-privilege controls on WordPress accounts to limit the population of users that can reach the vulnerable endpoint.
# Example php.ini hardening to reduce file inclusion impact
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
