CVE-2025-4857: Tribulant Newsletters RCE Vulnerability

CVE-2025-4857 Overview

CVE-2025-4857 is a Local File Inclusion (LFI) vulnerability in the Tribulant Newsletters plugin for WordPress. The flaw affects all versions up to and including 4.9.9.9 and exists in the handling of the file parameter within wp-mailinglist.php. Authenticated attackers with Administrator-level access can include and execute arbitrary files on the underlying server. Successful exploitation enables arbitrary PHP code execution, access control bypass, and disclosure of sensitive data. The vulnerability is tracked under [CWE-22] (Improper Limitation of a Pathname to a Restricted Directory).

Critical Impact
Authenticated administrators can chain this LFI with file uploads of seemingly safe types, such as images, to achieve remote code execution on the WordPress host.

Affected Products

Tribulant Newsletters plugin for WordPress, all versions through 4.9.9.9
WordPress sites running the newsletters-lite package distribution
WordPress installations where administrator accounts are shared or delegated to untrusted users

Discovery Timeline

2025-05-31 - CVE-2025-4857 published to the National Vulnerability Database
2025-07-10 - Last updated in NVD database

Technical Details for CVE-2025-4857

Vulnerability Analysis

The Newsletters plugin exposes functionality in wp-mailinglist.php that accepts a file parameter and passes it into a PHP include operation without sufficient validation. Because the parameter is user-controlled, an attacker can supply a relative or absolute path that traverses outside the intended directory. PHP then loads and executes whatever resides at that path. When the included file contains PHP code, the code runs in the context of the web server process. The attack vector requires network access and authentication at the Administrator role, which limits the population of viable attackers but raises the impact ceiling once that role is obtained.

Root Cause

The root cause is missing sanitization and allow-listing on the file parameter referenced near line 1584 of wp-mailinglist.php. The plugin treats the value as a trusted filesystem location and passes it to PHP file inclusion functions. No canonicalization, directory restriction, or extension validation is performed before the include occurs. This permits directory traversal sequences and absolute paths to reference arbitrary files on disk.

Attack Vector

An authenticated administrator submits a crafted request to the vulnerable endpoint, supplying a traversal path in the file parameter. The plugin includes the referenced file, executing any PHP it contains. Attackers commonly stage payloads by uploading a file with a permitted extension, such as an image containing embedded PHP, and then referencing it through the LFI. This converts a restricted file upload feature into a full remote code execution primitive. The technique also allows reading configuration files such as wp-config.php to harvest database credentials and secret keys.

No verified public proof-of-concept code is available. Refer to the Wordfence Vulnerability Report and the WordPress Mailing List Plugin Code for the exact code path involved.

Detection Methods for CVE-2025-4857

Indicators of Compromise

HTTP requests to WordPress admin endpoints containing a file parameter with traversal sequences such as ../, ..\, or absolute paths like /etc/passwd or wp-config.php
Web server access logs showing administrator-authenticated requests to Newsletters plugin handlers followed by anomalous PHP process activity
Newly created or modified PHP files inside the WordPress uploads directory, particularly files with image extensions that contain PHP tags
Outbound network connections initiated by the PHP-FPM or web server worker to attacker-controlled hosts shortly after Newsletters plugin requests

Detection Strategies

Inspect web server logs for requests to Newsletters endpoints carrying a file query or POST parameter and correlate against the administrator session that issued them
Deploy web application firewall rules that block path traversal patterns and absolute filesystem paths in any parameter named file
Monitor the WordPress uploads and plugin directories for file integrity changes using host-based file integrity monitoring
Hunt for PHP process spawns of system utilities such as sh, bash, curl, or wget originating from the web server user

Monitoring Recommendations

Centralize WordPress access and error logs in a SIEM and alert on requests containing traversal sequences against the Newsletters plugin
Baseline administrator activity and alert on plugin configuration changes outside of normal change windows
Track creation of files with double extensions or PHP content inside upload directories

How to Mitigate CVE-2025-4857

Immediate Actions Required

Update the Tribulant Newsletters plugin to a version newer than 4.9.9.9 that includes the fix from WordPress Changeset #3303758
Audit WordPress administrator accounts and remove unused or shared credentials; enforce multi-factor authentication on remaining accounts
Review the WordPress uploads directory for unexpected PHP files or images containing embedded PHP code
Rotate database credentials, WordPress salts, and API keys if compromise is suspected

Patch Information

The vendor addressed the issue in the commit recorded at WordPress Changeset #3303758. The fix restricts the values accepted by the file parameter in wp-mailinglist.php so that arbitrary paths can no longer be included. Site operators should update through the WordPress plugin manager or by deploying the patched plugin package manually.

Workarounds

Deactivate and remove the Newsletters plugin until the patched version is deployed
Configure PHP open_basedir to restrict file inclusion to the WordPress root directory
Add a web application firewall rule to block requests where the file parameter contains .., /, or \ characters against Newsletters endpoints
Restrict administrator panel access to known IP ranges using server-level controls such as .htaccess or reverse proxy rules

bash

# Example WAF rule (ModSecurity) to block traversal in the 'file' parameter
SecRule ARGS:file "@rx (\.\./|\.\.\\|^/)" \
    "id:1004857,phase:2,deny,status:403,\
    msg:'CVE-2025-4857 Newsletters LFI attempt blocked',\
    tag:'cwe-22',tag:'wordpress'"