CVE-2025-49271 Overview
CVE-2025-49271 is a Local File Inclusion (LFI) vulnerability in the GravityWP Merge Tags plugin for WordPress. The flaw stems from improper control of filenames used in PHP include or require statements [CWE-98]. Attackers can leverage this weakness to include arbitrary local files on the server, potentially leading to source code disclosure, sensitive data exposure, or remote code execution when combined with file upload primitives. The vulnerability affects all versions of gravitywp-merge-tags up to and including 1.4.4. Exploitation requires user interaction, but the attack vector is network-based and no authentication is needed.
Critical Impact
Successful exploitation allows an attacker to include and execute arbitrary PHP files from the WordPress server, compromising confidentiality, integrity, and availability of the affected site.
Affected Products
- GravityWP Merge Tags plugin for WordPress
- All versions from initial release through 1.4.4
- WordPress installations running the gravitywp-merge-tags plugin
Discovery Timeline
- 2025-08-14 - CVE-2025-49271 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-49271
Vulnerability Analysis
The GravityWP Merge Tags plugin fails to properly validate or sanitize filename input passed to PHP file inclusion functions. This is classified under [CWE-98] as Improper Control of Filename for Include/Require Statement. Although the advisory categorizes the issue as PHP Remote File Inclusion, the practical impact in this WordPress plugin is Local File Inclusion. Attackers can manipulate the filename parameter to traverse the filesystem and load arbitrary PHP files accessible to the web server process. Exploitation requires that a privileged user perform a specific action, raising the attack complexity. Once a file is included, its PHP content executes within the WordPress runtime, granting the attacker the same privileges as the web server.
Root Cause
The root cause is the absence of a strict allowlist or sanitization routine for filenames provided to a PHP include or require statement inside the plugin code. User-controllable input reaches the inclusion function without verification that the path resolves to a trusted file within an expected directory.
Attack Vector
An attacker crafts a request to a vulnerable plugin endpoint, supplying a manipulated filename parameter. After a target user interacts with the malicious request, the plugin includes the attacker-specified file. The attacker can target log files, uploaded media, or other writable locations containing attacker-controlled PHP to achieve code execution. The vulnerability manifests in the plugin's merge tag handling logic. See the Patchstack WordPress Vulnerability Advisory for additional technical context.
Detection Methods for CVE-2025-49271
Indicators of Compromise
- Unexpected HTTP requests containing path traversal sequences such as ../ or absolute filesystem paths in parameters passed to gravitywp-merge-tags endpoints.
- PHP error log entries referencing failed include or require calls originating from the plugin directory.
- Inclusion of files outside the plugin directory, including /etc/passwd, wp-config.php, or files from the WordPress uploads directory.
- Newly created or modified PHP files in uploads directories that correlate with plugin request activity.
Detection Strategies
- Inspect WordPress and web server access logs for requests targeting plugin endpoints with suspicious filename or path parameters.
- Deploy a Web Application Firewall (WAF) rule that blocks path traversal patterns and absolute path references in requests to /wp-content/plugins/gravitywp-merge-tags/.
- Monitor file integrity for the WordPress installation, particularly wp-content/uploads/ and plugin directories.
Monitoring Recommendations
- Enable verbose PHP error logging and forward logs to a centralized SIEM for correlation.
- Alert on outbound network connections initiated by the PHP-FPM or web server process to uncommon destinations.
- Track WordPress plugin inventory and version state continuously to identify hosts running gravitywp-merge-tags ≤ 1.4.4.
How to Mitigate CVE-2025-49271
Immediate Actions Required
- Identify all WordPress sites with the GravityWP Merge Tags plugin installed and confirm versions in use.
- Update the gravitywp-merge-tags plugin to a version newer than 1.4.4 once the vendor publishes a fix.
- If no patched version is yet available, deactivate and remove the plugin from production WordPress installations.
- Review web server and PHP error logs for prior exploitation attempts targeting the plugin.
Patch Information
At the time of publication, the advisory lists affected versions from initial release through 1.4.4. Administrators should consult the Patchstack WordPress Vulnerability Advisory for the latest patched version information and apply the update through the WordPress plugin manager.
Workarounds
- Disable the GravityWP Merge Tags plugin until a patched release is available.
- Apply WAF rules to block requests containing path traversal payloads or absolute paths to the affected plugin endpoints.
- Restrict PHP open_basedir and disable_functions directives to limit the impact of arbitrary file inclusion.
- Set restrictive filesystem permissions so that the web server account cannot read sensitive configuration files outside the WordPress webroot.
# Example php.ini hardening to constrain file inclusion impact
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
