CVE-2025-49892: Uxper Booking PHP File Inclusion Vulnerability

CVE-2025-49892 Overview

CVE-2025-49892 is a Local File Inclusion (LFI) vulnerability in the Uxper Booking WordPress plugin developed by uxper. The flaw affects all versions up to and including 1.3.3. It stems from improper control of filenames used in PHP include or require statements [CWE-98]. Attackers can trigger inclusion of arbitrary local PHP files, leading to code execution within the WordPress process context. The issue is classified under the PHP Remote File Inclusion category but is exploitable as Local File Inclusion in affected installations.

Critical Impact
Successful exploitation allows unauthenticated attackers to include local files and execute PHP code, compromising confidentiality, integrity, and availability of the WordPress site.

Affected Products

Uxper Booking plugin for WordPress, versions up to and including 1.3.3
WordPress installations using the uxper-booking plugin
Sites with unpatched uxper-booking deployments accessible over the network

Discovery Timeline

2025-08-20 - CVE-2025-49892 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-49892

Vulnerability Analysis

The vulnerability originates in how the Uxper Booking plugin handles user-supplied input passed to PHP file inclusion functions. When a request parameter influences the filename argument of include, include_once, require, or require_once, an attacker can direct the PHP interpreter to load an unintended file. In this case, the plugin fails to validate or sanitize the parameter before using it, enabling Local File Inclusion.

On a compromised WordPress host, attackers can include files such as configuration files, logs, or uploaded content. If an attacker controls any writable file on the server, for example a manipulated log file or uploaded image containing PHP payloads, inclusion of that file results in arbitrary code execution under the web server user. The high attack complexity reflects preconditions such as knowing exploitable file paths or leveraging a chained upload primitive.

Root Cause

The root cause is improper control of filenames used in PHP inclusion statements [CWE-98]. The plugin passes attacker-influenced input into an inclusion function without enforcing an allowlist, restricting to a specific directory, or stripping traversal sequences. This design permits inclusion of paths outside the plugin's intended scope.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker crafts an HTTP request to a vulnerable endpoint in the Uxper Booking plugin, supplying a parameter that resolves to a local file path. The PHP interpreter includes and executes the referenced file, granting the attacker the ability to read sensitive server data or execute PHP code in the WordPress process context.

Refer to the Patchstack Vulnerability Report for technical details.

Detection Methods for CVE-2025-49892

Indicators of Compromise

HTTP requests to Uxper Booking plugin endpoints containing directory traversal sequences such as ../ or absolute file paths in parameters
Web server access logs showing requests referencing wp-config.php, /etc/passwd, or /proc/self/environ in query strings
Unexpected PHP execution originating from files inside wp-content/uploads/ or plugin cache directories
Outbound network connections from the web server process following requests to uxper-booking endpoints

Detection Strategies

Inspect HTTP request logs for parameters targeting the uxper-booking plugin that contain path traversal patterns or references to sensitive filesystem locations
Monitor for PHP process activity spawning shell interpreters or writing new PHP files into the webroot
Correlate WordPress plugin version telemetry with the affected version range up to 1.3.3 to identify exposed installations

Monitoring Recommendations

Enable file integrity monitoring on WordPress plugin directories and wp-content/uploads/ for unexpected PHP file creation
Forward web server, PHP-FPM, and WordPress audit logs to a centralized analytics platform for retention and correlation
Establish alerts for anomalous parent-child process relationships between the web server and system binaries such as sh, bash, or curl

How to Mitigate CVE-2025-49892

Immediate Actions Required

Identify all WordPress instances running the Uxper Booking plugin at version 1.3.3 or earlier
Disable and remove the uxper-booking plugin until a patched version is confirmed installed
Restrict network access to WordPress administrative and plugin endpoints using a web application firewall
Review web server and application logs for exploitation attempts predating remediation

Patch Information

At the time of publication, no fixed version beyond 1.3.3 is referenced in the enriched CVE data. Consult the Patchstack Vulnerability Report for vendor updates and remediation guidance. Apply the vendor-supplied patch as soon as it becomes available.

Workarounds

Deactivate and remove the Uxper Booking plugin from affected WordPress sites
Deploy web application firewall rules to block requests containing path traversal sequences and known LFI payloads targeting plugin endpoints
Configure PHP with open_basedir restrictions to limit file inclusion to specific directories
Disable dangerous PHP functions and enforce least-privilege permissions on the web server user

bash

# Example php.ini hardening to restrict file inclusion scope
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off