CVE-2025-52814: BRW OVA-BRW Path Traversal Vulnerability

CVE-2025-52814 Overview

CVE-2025-52814 is a PHP Local File Inclusion (LFI) vulnerability in the ovatheme BRW (ova-brw) WordPress plugin. The flaw stems from improper control of filenames used in PHP include or require statements, classified under [CWE-98]. The vulnerability affects BRW versions up to and including 1.8.7. An unauthenticated attacker can craft requests that force the application to include arbitrary local files on the server. Successful exploitation can disclose sensitive files, execute embedded PHP, and compromise the WordPress host.

Critical Impact
Remote attackers can include arbitrary local PHP files without authentication, potentially leading to full site compromise and code execution.

Affected Products

ovatheme BRW (ova-brw) WordPress plugin versions through 1.8.7
WordPress installations running vulnerable BRW plugin builds
Hosting environments where attacker-controlled files can be written to disk

Discovery Timeline

2025-06-27 - CVE-2025-52814 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-52814

Vulnerability Analysis

The BRW plugin passes user-controlled input into a PHP file inclusion statement without proper validation or path canonicalization. An attacker sends an HTTP request containing a manipulated filename parameter. The plugin resolves that value as a filesystem path and executes any PHP code found in the included file. Because the inclusion target is resolved on the server, attackers can read configuration files such as wp-config.php, application logs, or session data. If the attacker can place a PHP payload on disk through log poisoning, file upload, or session injection, the LFI escalates to remote code execution. EPSS data shows a probability of 0.547% at the 68th percentile, indicating measurable interest from threat actors.

Root Cause

The root cause is missing allow-list validation on the parameter passed to include, require, include_once, or require_once. The plugin trusts request input to identify which PHP template or module to load. Without sanitization, traversal sequences such as ../ and absolute paths reach the inclusion call. This is the canonical pattern described by [CWE-98], Improper Control of Filename for Include/Require Statement.

Attack Vector

The attack is delivered over the network with no authentication or user interaction. An attacker crafts an HTTP request to a vulnerable BRW plugin endpoint and supplies a path parameter pointing to a sensitive local file. The server returns the contents or executes the file as PHP. See the Patchstack WordPress Vulnerability advisory for additional technical context. No verified proof-of-concept code is published at this time.

Detection Methods for CVE-2025-52814

Indicators of Compromise

HTTP requests to BRW plugin endpoints containing path traversal sequences such as ../../, ..\\, or URL-encoded variants %2e%2e%2f
Access log entries referencing sensitive paths such as wp-config.php, /etc/passwd, or php://filter
Unexpected PHP execution from non-standard directories such as wp-content/uploads/ or temporary directories
Outbound connections originating from the PHP worker process after suspicious BRW requests

Detection Strategies

Inspect web server access logs for requests targeting ova-brw parameters that contain filesystem path characters
Deploy Web Application Firewall (WAF) rules that block traversal sequences and known LFI wrapper schemes such as php://, data://, and expect://
Correlate file read events on sensitive WordPress files with the originating HTTP request to detect inclusion abuse
Monitor PHP-FPM and Apache error logs for inclusion warnings referencing attacker-supplied paths

Monitoring Recommendations

Alert on access to wp-config.php from the web worker process outside of normal application startup
Track child processes spawned by php-fpm or httpd for unusual command execution following BRW requests
Enable file integrity monitoring on the wp-content/plugins/ova-brw/ directory to detect tampering

How to Mitigate CVE-2025-52814

Immediate Actions Required

Update the BRW plugin to a release later than 1.8.7 once the vendor publishes a patched version
Deactivate and remove the ova-brw plugin if no fixed release is available for your environment
Audit web server logs for prior exploitation attempts targeting BRW endpoints with traversal payloads
Rotate WordPress secrets in wp-config.php and database credentials if exploitation indicators are present

Patch Information

Refer to the Patchstack WordPress Vulnerability advisory for vendor patch status. All BRW versions up to and including 1.8.7 are affected. Apply the vendor-released fix as soon as it becomes available through the WordPress plugin repository.

Workarounds

Restrict access to BRW plugin endpoints using WAF rules that deny traversal characters and PHP stream wrappers
Set open_basedir in PHP configuration to confine file inclusion to the WordPress document root
Disable allow_url_include and confirm allow_url_fopen is set to Off in php.ini
Apply least-privilege filesystem permissions so the web server user cannot read sensitive system files

bash

# Configuration example - php.ini hardening
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html/:/tmp/"