CVE-2025-48136: Estatik Mortgage Calculator LFI Vulnerability

CVE-2025-48136 Overview

CVE-2025-48136 is a PHP Local File Inclusion (LFI) vulnerability in the Estatik Mortgage Calculator WordPress plugin. The flaw stems from improper control of a filename used in PHP include/require statements [CWE-98, CWE-706]. Authenticated attackers with low privileges can manipulate file path parameters to load arbitrary local files through the PHP interpreter. All plugin versions up to and including 2.0.12 are affected. Successful exploitation can lead to source code disclosure, configuration leakage, and code execution when attacker-controlled content reaches an included path.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, enabling code execution in the WordPress site context and full compromise of confidentiality, integrity, and availability.

Affected Products

Estatik Mortgage Calculator WordPress plugin versions up to and including 2.0.12
WordPress sites running the estatik-mortgage-calculator plugin
Hosting environments where the plugin is installed with default configuration

Discovery Timeline

2025-05-16 - CVE-2025-48136 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-48136

Vulnerability Analysis

The vulnerability is classified as Improper Control of Filename for Include/Require Statement in PHP Program [CWE-98], commonly referred to as PHP Remote File Inclusion, with practical impact here being Local File Inclusion. The plugin passes user-supplied input into a PHP include or require call without sufficient validation or allow-listing. As a result, the PHP runtime resolves and executes the referenced file path as PHP code.

Because execution occurs inside the WordPress process, any included file is parsed and run with the privileges of the web server user. Attackers can chain LFI with log poisoning, session file injection, or upload primitives to escalate to remote code execution. The issue affects confidentiality, integrity, and availability of the host application.

Root Cause

The root cause is the use of untrusted input in a dynamic file inclusion sink without canonicalization, allow-listing, or path normalization. The plugin does not enforce that requested paths resolve within an expected directory, allowing traversal sequences such as ../ to reach files outside the intended scope.

Attack Vector

Exploitation occurs over the network against the WordPress site. The attacker must hold a low-privileged authenticated session and no user interaction is required. The attacker submits a crafted request to a plugin endpoint that reaches the vulnerable include sink, supplying a path to a sensitive local file or attacker-controlled content. Refer to the Patchstack Plugin Vulnerability Report for sink details.

Detection Methods for CVE-2025-48136

Indicators of Compromise

HTTP requests to Estatik Mortgage Calculator endpoints containing path traversal sequences such as ../, encoded variants like %2e%2e%2f, or null byte %00 payloads.
Web server access logs showing references to sensitive paths such as wp-config.php, /etc/passwd, or PHP session files in plugin parameters.
Unexpected PHP errors referencing include() or require() with non-plugin file paths in error logs.

Detection Strategies

Inspect plugin request parameters for filesystem path patterns and reject requests whose values do not match an allow-listed identifier.
Correlate authenticated subscriber-level activity with file inclusion error signatures to surface low-privilege exploitation.
Apply WAF rules targeting Local File Inclusion signatures on routes belonging to the estatik-mortgage-calculator plugin.

Monitoring Recommendations

Monitor WordPress wp-content/plugins/estatik-mortgage-calculator/ for unexpected file access and modification.
Alert on PHP error log entries containing failed to open stream originating from plugin code paths.
Track new low-privileged account registrations followed by requests to plugin AJAX or admin-post endpoints.

How to Mitigate CVE-2025-48136

Immediate Actions Required

Identify all WordPress installations running Estatik Mortgage Calculator version 2.0.12 or earlier and prioritize remediation.
Disable the plugin until a vendor patch superseding 2.0.12 is installed and verified.
Audit user accounts and remove unused low-privileged accounts that could be leveraged for authenticated exploitation.
Rotate WordPress secrets in wp-config.php and database credentials if exploitation is suspected.

Patch Information

At the time of NVD publication, the vulnerability affects all versions up to and including 2.0.12. Administrators should consult the Patchstack Plugin Vulnerability Report and the WordPress plugin repository for fixed releases, and update through the WordPress admin dashboard once a patched version is available.

Workarounds

Remove or deactivate the estatik-mortgage-calculator plugin until a patched version is deployed.
Deploy a Web Application Firewall rule blocking path traversal characters and absolute paths in plugin parameters.
Set open_basedir in PHP to restrict file access to the WordPress document root and required directories.
Disable allow_url_include and allow_url_fopen in php.ini to limit inclusion to local files only.

bash

# Configuration example: restrict PHP file inclusion scope
# /etc/php/php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Disable plugin via WP-CLI until patched
wp plugin deactivate estatik-mortgage-calculator