CVE-2025-49307: WP Multilang Path Traversal Vulnerability

CVE-2025-49307 Overview

CVE-2025-49307 is a Local File Inclusion (LFI) vulnerability in the Magazine3 WP Multilang plugin for WordPress. The flaw stems from improper control of filenames passed to PHP include or require statements [CWE-98]. Authenticated attackers can manipulate file path parameters to include arbitrary local files on the server. The vulnerability affects WP Multilang versions up to and including 2.4.19. Successful exploitation can lead to source code disclosure, sensitive data exposure, and potential remote code execution if attackers can write to files included by the application.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, potentially leading to information disclosure, code execution, and full site compromise.

Affected Products

Magazine3 WP Multilang plugin for WordPress
All versions from initial release through 2.4.19
WordPress sites running the vulnerable wp-multilang plugin

Discovery Timeline

2025-06-06 - CVE-2025-49307 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-49307

Vulnerability Analysis

The vulnerability resides in the WP Multilang plugin's handling of file path parameters used in PHP include or require statements. The plugin fails to properly validate or sanitize user-supplied input before passing it to file inclusion functions. This allows attackers with low-privileged authenticated access to traverse the filesystem and include arbitrary PHP files. The attack vector is network-based but requires high attack complexity and low privileges. Successful exploitation impacts confidentiality, integrity, and availability of the WordPress installation.

Root Cause

The root cause is improper control of filename for include/require statement [CWE-98], commonly known as PHP Remote File Inclusion. The plugin accepts user-controlled input as part of a file path argument without enforcing an allowlist of acceptable values. PHP then resolves the path and executes any matching file as PHP code. This pattern transforms a parameter handling bug into a code execution primitive when attackers can influence what gets loaded.

Attack Vector

An authenticated attacker sends a crafted HTTP request to a vulnerable WP Multilang endpoint with a manipulated file path parameter. The plugin passes this value to include or require, causing PHP to load and execute the targeted file. Attackers commonly target WordPress configuration files such as wp-config.php, log files containing attacker-controlled content, or session files. The high attack complexity reflects the authentication requirement and specific conditions needed to reach the vulnerable code path.

For technical details, see the Patchstack WP Multilang Vulnerability advisory.

Detection Methods for CVE-2025-49307

Indicators of Compromise

HTTP requests to WP Multilang endpoints containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f
Web server access logs showing parameters referencing sensitive files such as wp-config.php, /etc/passwd, or PHP wrappers like php://filter
Unexpected PHP errors related to include or require failures in WordPress error logs
Anomalous file read activity from the PHP process targeting files outside the plugin directory

Detection Strategies

Inspect WordPress access logs for requests targeting wp-multilang plugin paths with suspicious query parameters
Deploy a web application firewall (WAF) with rules to identify LFI patterns and PHP wrapper abuse
Monitor PHP file inclusion behavior using runtime application self-protection (RASP) or file integrity monitoring
Correlate authenticated user activity with abnormal file access patterns to identify low-privileged accounts probing the plugin

Monitoring Recommendations

Enable verbose logging on WordPress endpoints exposed to authenticated users
Alert on access to sensitive files such as wp-config.php by the web server process outside normal application flow
Track plugin version inventory across WordPress deployments to identify unpatched WP Multilang installations
Monitor for new or modified PHP files in upload directories that could be staged for inclusion

How to Mitigate CVE-2025-49307

Immediate Actions Required

Identify all WordPress sites running the WP Multilang plugin and verify installed versions
Update WP Multilang to a version newer than 2.4.19 once a patched release is available from Magazine3
Restrict authenticated access to trusted users while a patch is being deployed
Review WordPress access logs for evidence of exploitation attempts targeting the plugin

Patch Information

At the time of publication, the vulnerability affects WP Multilang versions through 2.4.19. Administrators should consult the Patchstack advisory for the latest remediation guidance and confirm a fixed version is installed before re-enabling the plugin.

Workarounds

Deactivate and remove the WP Multilang plugin until a patched version is installed
Deploy WAF rules to block requests containing path traversal sequences and PHP stream wrappers
Apply the principle of least privilege to WordPress user accounts to limit who can reach the vulnerable code path
Configure PHP open_basedir restrictions to constrain which files the web application can include

bash

# Example PHP open_basedir restriction in php.ini
open_basedir = "/var/www/html/:/tmp/"
disable_functions = "system,exec,shell_exec,passthru"
allow_url_include = Off
allow_url_fopen = Off