CVE-2025-49264: Cloud SAML SSO Path Traversal Vulnerability

CVE-2025-49264 Overview

CVE-2025-49264 is a PHP Local File Inclusion (LFI) vulnerability in the Cloud SAML SSO - Single Sign On Login plugin for WordPress, developed by Cloud Infrastructure Services. The flaw exists in the cloud-sso-single-sign-on plugin from unspecified versions up to and including 1.0.18. The vulnerability stems from improper control of the filename used in PHP include or require statements [CWE-98]. Attackers can leverage the flaw to load arbitrary local files through the vulnerable include path. Successful exploitation can lead to source code disclosure, configuration file exposure, and potential code execution if attacker-controlled content reaches the included file.

Critical Impact
Remote attackers can include arbitrary PHP files on the server, exposing sensitive data and enabling potential code execution on affected WordPress installations.

Affected Products

Cloud Infrastructure Services Cloud SAML SSO - Single Sign On Login (cloud-sso-single-sign-on) plugin
All versions through 1.0.18
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-08-14 - CVE-2025-49264 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-49264

Vulnerability Analysis

The vulnerability is classified under [CWE-98]: Improper Control of Filename for Include/Require Statement in PHP Program. The Cloud SAML SSO plugin passes user-influenced input into a PHP include or require call without proper validation or path sanitization. This allows traversal sequences or absolute paths to reference files outside the intended directory.

An attacker who supplies a crafted filename parameter can force the PHP interpreter to execute or read arbitrary files on the local file system. Disclosed files typically include wp-config.php, which contains database credentials and authentication keys, and other configuration artifacts. If the attacker can write attacker-controlled content to any location reachable by the include statement, this LFI can escalate to remote code execution.

Exploitation requires user interaction, which limits drive-by abuse but remains practical through social engineering or authenticated session triggering of the vulnerable endpoint.

Root Cause

The root cause is the absence of allowlisting and path normalization around an include/require operation. The plugin accepts a filename derived from request input and concatenates it into a filesystem path without restricting it to a trusted directory or removing directory traversal sequences such as ../.

Attack Vector

The attack is network-based and targets the vulnerable plugin endpoint over HTTP. An attacker crafts a request supplying a manipulated filename parameter. After a victim triggers the request, the server-side PHP code includes the attacker-specified path, executing or disclosing its contents within the WordPress runtime context.

No verified public exploit code is available at this time. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-49264

Indicators of Compromise

HTTP requests to cloud-sso-single-sign-on plugin endpoints containing path traversal sequences such as ../ or URL-encoded variants like %2e%2e%2f
Web server access log entries referencing sensitive files such as wp-config.php, /etc/passwd, or PHP session files passed as parameters
Unexpected PHP include or require warnings in error logs referencing paths outside the plugin directory

Detection Strategies

Inspect WordPress and web server logs for requests targeting the plugin's PHP endpoints with suspicious filename parameters
Deploy web application firewall (WAF) rules that flag directory traversal patterns and PHP wrapper schemes such as php://filter and data://
Correlate plugin endpoint requests with subsequent file reads of WordPress configuration files

Monitoring Recommendations

Enable verbose logging on the WordPress installation and forward logs to a centralized analytics pipeline
Monitor for new PHP processes or file writes initiated by the web server user following requests to the vulnerable plugin
Track outbound connections from the WordPress host that could indicate post-exploitation activity

How to Mitigate CVE-2025-49264

Immediate Actions Required

Disable or remove the Cloud SAML SSO - Single Sign On Login plugin until a patched version is installed
Rotate all secrets stored in wp-config.php, including database credentials and authentication keys, if exploitation is suspected
Restrict access to WordPress administrative endpoints using IP allowlists or authentication gateways

Patch Information

The vulnerability affects versions through 1.0.18. Administrators should monitor the Patchstack advisory and the WordPress plugin repository for an updated release and apply it immediately upon availability.

Workarounds

Remove the cloud-sso-single-sign-on plugin directory from wp-content/plugins/ if a patched release is not yet available
Configure a WAF rule to block requests containing directory traversal sequences or PHP stream wrappers targeting plugin endpoints
Set the PHP open_basedir directive to confine file inclusion to the WordPress installation directory

bash

# Example PHP open_basedir restriction in php.ini
open_basedir = "/var/www/html/wordpress/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off