CVE-2025-53450: Easy Pricing Table WP LFI Vulnerability

CVE-2025-53450 Overview

CVE-2025-53450 is a PHP Local File Inclusion (LFI) vulnerability in the Pluginwale Easy Pricing Table WP WordPress plugin. The flaw stems from improper control of a filename used in a PHP include or require statement [CWE-98]. Authenticated attackers with low privileges can abuse this weakness to load arbitrary local PHP files, leading to information disclosure or code execution within the WordPress context. The vulnerability affects all versions of easy-pricing-table-wp up to and including 1.1.3.

Critical Impact
Successful exploitation enables an authenticated attacker to include arbitrary local files on the WordPress host, compromising confidentiality, integrity, and availability of the affected site.

Affected Products

Pluginwale Easy Pricing Table WP (easy-pricing-table-wp) — all versions through 1.1.3
WordPress installations with the plugin enabled
Hosting environments where additional PHP files are readable by the web server user

Discovery Timeline

2025-09-22 - CVE-2025-53450 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-53450

Vulnerability Analysis

The vulnerability is classified as Improper Control of Filename for Include/Require Statement in PHP Program [CWE-98]. The plugin accepts attacker-controlled input and passes it to a PHP file inclusion function without sufficient validation or sanitization. An attacker with at least low-level authenticated access can manipulate the filename parameter to traverse the filesystem and include arbitrary PHP files reachable by the web server process.

Because the included file is parsed by the PHP interpreter, any PHP code present in the included file executes in the context of the WordPress application. This converts a file inclusion into arbitrary code execution when the attacker can stage or reach a PHP file containing controlled content, such as a log file, uploaded asset, or session storage location.

The issue is exploitable over the network, but the published CVSS vector indicates high attack complexity, reflecting non-trivial preconditions such as specific request crafting or environmental requirements.

Root Cause

The root cause is the absence of an allowlist or strict path validation before passing user-controlled input to a PHP include or require statement inside the plugin code. Path normalization and extension enforcement are not applied, allowing directory traversal sequences and absolute paths to resolve to unintended files.

Attack Vector

The attack vector is network-based and requires authentication. An authenticated user submits a crafted HTTP request to a plugin endpoint that performs file inclusion. The request supplies a manipulated filename parameter that resolves to a local file the attacker wishes to read or execute. The vulnerability does not require user interaction once the attacker is authenticated.

For verified technical details, see the Patchstack WordPress Vulnerability advisory.

Detection Methods for CVE-2025-53450

Indicators of Compromise

HTTP requests to Easy Pricing Table WP endpoints containing path traversal sequences such as ../, encoded variants like %2e%2e%2f, or absolute filesystem paths in query or POST parameters.
WordPress access logs showing authenticated users issuing parameter values that reference php://, /etc/, wp-config.php, or other sensitive file paths.
Unexpected PHP errors or warnings in the web server log referencing include(), require(), or failed to open stream from plugin source files.

Detection Strategies

Inspect web server and WordPress logs for requests targeting easy-pricing-table-wp plugin paths that include filename-style parameters.
Deploy web application firewall (WAF) rules that flag directory traversal patterns and PHP wrapper schemes in request parameters bound to the affected plugin.
Correlate authenticated session activity with abnormal file access patterns, especially low-privilege accounts touching administrative endpoints.

Monitoring Recommendations

Monitor WordPress accounts with subscriber or contributor roles for unusual request volume against plugin endpoints.
Alert on PHP process file reads outside the WordPress document root, such as access to /etc/passwd, wp-config.php, or session files.
Track plugin version inventory across managed WordPress sites and alert when easy-pricing-table-wp 1.1.3 or earlier is detected.

How to Mitigate CVE-2025-53450

Immediate Actions Required

Identify all WordPress sites running the Easy Pricing Table WP plugin and confirm the installed version.
Deactivate the plugin on any site running version 1.1.3 or earlier until a fixed release is installed.
Rotate WordPress credentials and review user accounts for unauthorized low-privilege users that could exploit the flaw.
Audit the filesystem and database for signs of unauthorized file reads, webshell deployment, or modified plugin or theme files.

Patch Information

At the time of NVD publication, no fixed version is listed for easy-pricing-table-wp. The advisory states the issue affects versions through 1.1.3. Monitor the Patchstack advisory and the plugin's WordPress.org page for an updated release, and apply the patch immediately once available.

Workarounds

Remove or deactivate the Easy Pricing Table WP plugin until a patched version is released.
Apply WAF rules that block path traversal sequences and PHP wrapper schemes in parameters destined for plugin endpoints.
Restrict registration and limit low-privilege account creation to reduce the population of authenticated users who could reach the vulnerable code path.
Harden PHP configuration by disabling allow_url_include and constraining open_basedir to the WordPress installation directory.

bash

# Example PHP hardening in php.ini to limit file inclusion scope
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html/wordpress:/tmp"