CVE-2025-52716: WP REST Cache LFI Vulnerability

CVE-2025-52716 Overview

CVE-2025-52716 is a Local File Inclusion (LFI) vulnerability affecting the WP REST Cache WordPress plugin developed by Acato. The vulnerability stems from improper control of filename for include/require statements in PHP programs, which allows attackers to include local files on the server through manipulated input parameters. This flaw can lead to unauthorized access to sensitive files, potential information disclosure, and in some cases may be chained with other vulnerabilities to achieve remote code execution.

Critical Impact

Attackers can leverage this Local File Inclusion vulnerability to read sensitive configuration files, access credentials, or potentially execute arbitrary PHP code if combined with file upload capabilities or log poisoning techniques.

Affected Products

• WP REST Cache plugin versions through 2025.1.0
• WordPress installations running vulnerable versions of the WP REST Cache plugin

Discovery Timeline

• 2025-08-14 - CVE-2025-52716 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-52716

Vulnerability Analysis

This vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The WP REST Cache plugin fails to properly sanitize user-controlled input before using it in PHP include or require statements. This allows attackers to manipulate file path parameters to include arbitrary local files from the server's filesystem.

Local File Inclusion vulnerabilities in WordPress plugins are particularly dangerous because they can expose sensitive WordPress configuration files such as wp-config.php, which typically contains database credentials and authentication keys. The network-based attack vector means exploitation can be performed remotely, though the high attack complexity indicates that successful exploitation may require specific conditions or additional reconnaissance.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization within the WP REST Cache plugin's file handling mechanisms. When the plugin processes requests related to REST API caching, it accepts user-controllable parameters that are subsequently used in PHP include or require statements without adequate path traversal filtering or whitelist validation. This allows attackers to break out of intended directories and include files from arbitrary locations on the server.

Attack Vector

The vulnerability is exploitable over the network (AV:N) with high attack complexity (AC:H). Exploitation requires no prior authentication (PR:N) but does require user interaction (UI:R). A successful attack can result in high impact to confidentiality, integrity, and availability of the affected system.

An attacker would typically craft malicious requests containing path traversal sequences (such as ../) in vulnerable parameters to navigate outside the intended directory structure. By targeting files like /etc/passwd, wp-config.php, or log files, attackers can extract sensitive information. When combined with techniques like log poisoning or if file upload functionality exists, this LFI vulnerability could potentially be escalated to remote code execution.

For technical details and proof-of-concept information, refer to the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2025-52716

Indicators of Compromise

• Unusual requests to WordPress REST API endpoints containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f
• Web server logs showing access attempts to sensitive files like wp-config.php, /etc/passwd, or log files through the WP REST Cache plugin
• Unexpected file read operations originating from WordPress plugin directories
• Error messages or responses revealing file system paths or contents

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in requests targeting WordPress REST endpoints
• Monitor access logs for requests containing null bytes (%00), double encoding, or Unicode path traversal attempts
• Deploy file integrity monitoring on critical WordPress configuration files
• Utilize WordPress security plugins that can detect suspicious file inclusion attempts

Monitoring Recommendations

• Enable detailed logging for WordPress REST API requests and monitor for anomalous patterns
• Configure SIEM alerts for path traversal indicators in web application logs
• Regularly audit installed WordPress plugins and their access patterns
• Monitor for unauthorized access attempts to sensitive PHP files and configuration data

How to Mitigate CVE-2025-52716

Immediate Actions Required

• Immediately audit your WordPress installation to determine if the WP REST Cache plugin is installed
• If running version 2025.1.0 or earlier, check for available updates from the plugin developer
• Consider temporarily disabling the WP REST Cache plugin until a patched version is available
• Implement WAF rules to block path traversal attempts as an interim protective measure
• Review server access logs for any signs of exploitation attempts

Patch Information

Organizations should monitor the Patchstack WordPress Vulnerability Report for updated patch information from the plugin vendor. Update to the latest version of WP REST Cache once a security patch addressing this vulnerability is released.

Workarounds

• Disable the WP REST Cache plugin entirely if caching functionality is not critical to operations
• Implement server-level restrictions using .htaccess or nginx configuration to limit access to sensitive files
• Deploy a Web Application Firewall with rules specifically designed to block LFI and path traversal attacks
• Apply the principle of least privilege to WordPress file system permissions to minimize potential impact

# Apache .htaccess example to restrict sensitive file access
<FilesMatch "^wp-config\.php$">
    Order allow,deny
    Deny from all
</FilesMatch>

# Block common path traversal patterns
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC,OR]
RewriteCond %{QUERY_STRING} (base64_encode|base64_decode) [NC]
RewriteRule .* - [F,L]