CVE-2025-54750: FunnelKit Funnel Builder LFI Vulnerability

CVE-2025-54750 Overview

CVE-2025-54750 is a Local File Inclusion (LFI) vulnerability affecting the Funnel Builder by FunnelKit WordPress plugin. The vulnerability stems from improper control of filename for include/require statements in PHP, allowing attackers to include local files on the server. This security flaw enables malicious actors to potentially read sensitive configuration files, access credentials, or leverage the inclusion mechanism to execute arbitrary PHP code under certain conditions.

Critical Impact

Attackers exploiting this vulnerability can read sensitive server files, potentially exposing database credentials, configuration secrets, and other sensitive data. In certain configurations, this can be chained with other vulnerabilities to achieve remote code execution.

Affected Products

• Funnel Builder by FunnelKit WordPress Plugin versions up to and including 3.11.1
• WordPress installations running vulnerable versions of the funnel-builder plugin

Discovery Timeline

• 2025-08-20 - CVE-2025-54750 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2025-54750

Vulnerability Analysis

This vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Funnel Builder plugin fails to properly sanitize user-controlled input before using it in PHP include or require statements. This allows an attacker to manipulate the file path parameter to include arbitrary local files from the server's filesystem.

Local File Inclusion vulnerabilities in WordPress plugins are particularly dangerous because they can expose the wp-config.php file, which contains database credentials, authentication keys, and salts. Additionally, if an attacker can upload a file to the server (even with an innocuous extension), they may be able to include that file and execute arbitrary PHP code.

Root Cause

The root cause of this vulnerability lies in insufficient input validation and sanitization within the Funnel Builder plugin. The affected code path accepts user-supplied input that influences the filename or path used in PHP's include(), require(), include_once(), or require_once() functions. Without proper validation, attackers can use directory traversal sequences (e.g., ../) or other path manipulation techniques to escape the intended directory and include arbitrary files.

Attack Vector

The attack vector for this vulnerability involves manipulating HTTP request parameters that are subsequently used in file inclusion operations. An attacker would typically craft a malicious request containing path traversal sequences to navigate the filesystem and include sensitive files such as /etc/passwd on Linux systems or WordPress configuration files like wp-config.php.

The exploitation process generally follows these steps:

1. The attacker identifies a vulnerable parameter in the Funnel Builder plugin that accepts file path input
2. A crafted request is sent with directory traversal sequences (e.g., ../../wp-config.php)
3. The vulnerable code includes the specified file without proper sanitization
4. The contents of the included file are returned to the attacker or executed as PHP code

For detailed technical information, refer to the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-54750

Indicators of Compromise

• Unusual HTTP requests to WordPress containing path traversal patterns such as ../ or encoded variants (%2e%2e%2f)
• Web server logs showing requests attempting to access sensitive files like wp-config.php, /etc/passwd, or /proc/self/environ
• Unexpected file access patterns in PHP error logs indicating attempted inclusion of non-existent or restricted files
• Evidence of reconnaissance activity targeting the Funnel Builder plugin endpoints

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal attempts in HTTP parameters
• Configure intrusion detection systems to alert on patterns associated with LFI exploitation, including encoded directory traversal sequences
• Monitor WordPress access logs for anomalous requests targeting the funnel-builder plugin directory
• Deploy file integrity monitoring to detect unauthorized access to sensitive configuration files

Monitoring Recommendations

• Enable verbose logging for the web server and PHP to capture detailed request information
• Set up alerts for failed file access attempts that indicate directory traversal patterns
• Monitor system-level file access to critical files like wp-config.php using audit tools
• Implement real-time log analysis to detect exploitation attempts before sensitive data is exfiltrated

How to Mitigate CVE-2025-54750

Immediate Actions Required

• Update the Funnel Builder by FunnelKit plugin to the latest patched version immediately
• Audit WordPress installations to identify all sites running vulnerable versions of the plugin
• Review web server logs for evidence of exploitation attempts targeting this vulnerability
• Consider temporarily disabling the plugin if an immediate update is not possible

Patch Information

Users should update the Funnel Builder by FunnelKit plugin to a version newer than 3.11.1. The update addresses the improper input validation that allows local file inclusion. For the latest security information and patch details, consult the Patchstack Vulnerability Report.

Workarounds

• Implement server-side path validation by configuring open_basedir restrictions in PHP to limit file inclusion to specific directories
• Deploy a Web Application Firewall with rules specifically targeting LFI patterns and directory traversal attempts
• Restrict file permissions on sensitive configuration files to prevent unauthorized read access even if inclusion is attempted
• Use security plugins that provide virtual patching capabilities until the official update can be applied

# PHP configuration hardening example
# Add to php.ini or .htaccess to restrict file access
php_admin_value open_basedir "/var/www/html:/tmp"

# Apache mod_rewrite rule to block common LFI patterns
RewriteEngine On
RewriteCond %{QUERY_STRING} (\.\./|\.\.\\) [NC,OR]
RewriteCond %{QUERY_STRING} (etc/passwd|wp-config\.php) [NC]
RewriteRule .* - [F,L]