CVE-2025-47693: FAT Services Booking LFI Vulnerability

CVE-2025-47693 Overview

CVE-2025-47693 is a PHP Local File Inclusion (LFI) vulnerability in the roninwp FAT Services Booking WordPress plugin (fat-services-booking). The flaw stems from improper control of a filename used in a PHP include or require statement [CWE-98]. All versions through 5.5 are affected. Authenticated attackers with low privileges can leverage the issue over the network to include arbitrary local PHP files. Successful exploitation impacts confidentiality, integrity, and availability of the WordPress site.

Critical Impact
Authenticated attackers can include arbitrary local PHP files on the server, leading to sensitive data disclosure and potential remote code execution when combined with file upload primitives.

Affected Products

WordPress plugin: roninwp FAT Services Booking (fat-services-booking)
All versions from n/a through <= 5.5
WordPress sites running the plugin with low-privileged authenticated users

Discovery Timeline

2025-05-16 - CVE-2025-47693 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-47693

Vulnerability Analysis

The vulnerability resides in how the FAT Services Booking plugin constructs the argument passed to a PHP include, include_once, require, or require_once statement. User-controlled input flows into the filename parameter without proper sanitization or allow-list validation. As a result, an attacker can manipulate path components to load arbitrary local PHP files within the web server's reachable filesystem. The Common Weakness Enumeration classifies this pattern as [CWE-98], Improper Control of Filename for Include/Require Statement in PHP Program.

Root Cause

The plugin accepts a request parameter that is concatenated into a dynamic include path. Sanitization routines fail to strip path traversal sequences such as ../ and do not enforce a whitelist of permitted filenames. The interpreter resolves the supplied path and executes any PHP code it loads under the privileges of the web server process.

Attack Vector

Exploitation requires network access to the WordPress site and authentication at a low privilege level, such as a subscriber or contributor account. The attacker sends a crafted HTTP request to a vulnerable plugin endpoint, supplying a manipulated filename value. The PHP runtime then loads and executes the targeted file. When combined with attacker-controlled content on the filesystem, such as uploaded media or log files, the LFI can be escalated to remote code execution. Refer to the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-47693

Indicators of Compromise

HTTP requests to fat-services-booking plugin endpoints containing path traversal sequences such as ../, encoded variants (%2e%2e%2f), or absolute paths
PHP error log entries referencing include(), require(), or failed to open stream for unexpected file paths
Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or session storage from the web server process
Authenticated sessions from low-privilege accounts issuing requests to administrative or AJAX endpoints of the plugin

Detection Strategies

Inspect web server access logs for plugin requests carrying file path parameters and traversal patterns
Apply web application firewall rules that block path traversal payloads on parameters destined for the plugin
Correlate authenticated user activity with file inclusion error messages to surface exploitation attempts

Monitoring Recommendations

Alert on PHP fatal errors or warnings tied to include/require calls within the fat-services-booking directory
Monitor for child processes spawned by the web server account that deviate from a normal baseline
Track read access to credential files and WordPress configuration files by the PHP-FPM or Apache worker user

How to Mitigate CVE-2025-47693

Immediate Actions Required

Update the FAT Services Booking plugin to a version released after 5.5 once the vendor publishes a fix
Restrict low-privilege account creation and audit existing subscriber and contributor accounts
Deploy WAF signatures that block path traversal patterns on requests to plugin endpoints
Review web server and PHP error logs for prior exploitation evidence

Patch Information

At the time of NVD publication, all versions through 5.5 are listed as vulnerable. Site operators should consult the Patchstack Vulnerability Report for the latest fixed version and upgrade guidance.

Workarounds

Disable or remove the fat-services-booking plugin until a patched release is available
Configure PHP open_basedir to confine file inclusion to the WordPress installation directory
Set allow_url_include=Off and allow_url_fopen=Off in php.ini to limit inclusion primitives
Apply least privilege to the web server user so sensitive files outside the web root are unreadable

bash

# Configuration example: harden php.ini against file inclusion abuse
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"