CVE-2025-53565: Google Reviews Widget LFI Vulnerability

CVE-2025-53565 Overview

CVE-2025-53565 is a Local File Inclusion (LFI) vulnerability in the RadiusTheme Widget for Google Reviews WordPress plugin (business-reviews-wp). The vulnerability stems from improper control of filename parameters used in PHP include/require statements, allowing attackers to include arbitrary local files from the server filesystem. This can lead to sensitive information disclosure, configuration file exposure, and potentially remote code execution when combined with other attack vectors.

Critical Impact

Attackers can exploit this LFI vulnerability to read sensitive server files, access WordPress configuration data including database credentials, and potentially escalate to remote code execution through log poisoning or file upload chaining.

Affected Products

• RadiusTheme Widget for Google Reviews (business-reviews-wp) versions through 1.0.15
• WordPress installations running the vulnerable plugin versions

Discovery Timeline

• 2025-08-20 - CVE-2025-53565 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-53565

Vulnerability Analysis

This vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Widget for Google Reviews plugin fails to properly sanitize user-controlled input before using it in PHP file inclusion operations. When a PHP application uses include(), require(), include_once(), or require_once() functions with unsanitized user input, attackers can manipulate the file path to include arbitrary local files.

In the context of WordPress plugins, this type of vulnerability is particularly dangerous because attackers can potentially read the wp-config.php file containing database credentials, access log files that may contain sensitive information, or read other plugin and theme files that could reveal additional vulnerabilities.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization of file path parameters within the plugin. The Widget for Google Reviews plugin accepts user input that directly or indirectly controls the filename used in PHP include statements without implementing proper allowlisting, path canonicalization, or directory traversal prevention mechanisms.

WordPress plugins commonly use dynamic file inclusion for loading templates, widgets, or configuration files. When developers fail to restrict inclusion paths to expected directories and file types, attackers can inject path traversal sequences (such as ../) or absolute paths to access files outside the intended scope.

Attack Vector

The attack vector for this LFI vulnerability involves manipulating request parameters that are processed by the vulnerable plugin code. An attacker would typically craft a malicious request containing path traversal sequences to navigate up from the plugin directory and access sensitive system files.

Common exploitation targets include:

• /etc/passwd - User account information disclosure
• wp-config.php - WordPress database credentials and security keys
• .htaccess files - Server configuration details
• Log files - Potential for log poisoning to achieve RCE

The vulnerability can be exploited remotely through HTTP requests, though specific attack prerequisites depend on the plugin's implementation and whether authentication is required to access the vulnerable functionality.

For detailed technical information about this vulnerability, refer to the Patchstack WordPress Vulnerability Report.

Detection Methods for CVE-2025-53565

Indicators of Compromise

• Unusual file access patterns in web server logs showing path traversal sequences (../, ..%2f, %2e%2e/)
• HTTP requests targeting the Widget for Google Reviews plugin endpoints with suspicious path parameters
• Access attempts to sensitive files like wp-config.php, /etc/passwd, or log files through plugin routes
• Unexpected plugin activity or errors related to file inclusion operations

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in request parameters
• Monitor web server access logs for requests containing directory traversal sequences targeting the business-reviews-wp plugin
• Deploy file integrity monitoring to detect unauthorized access or reading of sensitive configuration files
• Use SentinelOne's behavioral detection capabilities to identify anomalous file access patterns from web server processes

Monitoring Recommendations

• Configure alerting for access attempts to sensitive WordPress files from plugin directories
• Monitor for repeated failed file access attempts that may indicate exploitation attempts
• Review plugin activity logs for unusual include or require operations
• Implement centralized logging to correlate suspicious requests across multiple WordPress installations

How to Mitigate CVE-2025-53565

Immediate Actions Required

• Update the Widget for Google Reviews (business-reviews-wp) plugin to a patched version above 1.0.15 as soon as one becomes available
• If no patch is available, consider temporarily disabling or uninstalling the plugin until a fix is released
• Implement WAF rules to block path traversal attempts targeting the vulnerable plugin endpoints
• Review server access logs for signs of exploitation attempts

Patch Information

Organizations using the Widget for Google Reviews plugin should check for updates through the WordPress plugin repository or contact RadiusTheme directly for security patches. Monitor the Patchstack vulnerability database for updated remediation guidance and patch availability.

Workarounds

• Temporarily disable the Widget for Google Reviews plugin until a patch is available
• Implement server-level restrictions using open_basedir PHP directive to limit file access scope
• Deploy WAF rules to filter requests containing path traversal patterns targeting the vulnerable plugin
• Restrict file permissions on sensitive configuration files to limit the impact of successful exploitation
• Consider using WordPress security plugins that provide virtual patching capabilities for known vulnerabilities

# Example: Add WAF rule to block path traversal in ModSecurity
SecRule REQUEST_URI|ARGS|ARGS_NAMES "@contains ../" \
    "id:100001,phase:2,deny,status:403,msg:'Path Traversal Attempt Blocked',tag:'LFI'"

# Example: Restrict PHP open_basedir in Apache virtual host
php_admin_value open_basedir "/var/www/html:/tmp"