CVE-2025-57889: InPost Gallery PHP File Inclusion Flaw

CVE-2025-57889 Overview

CVE-2025-57889 is a Local File Inclusion (LFI) vulnerability in the RealMag777 InPost Gallery plugin for WordPress. The flaw stems from improper control of filename arguments passed to PHP include or require statements, classified under [CWE-98]. All versions of InPost Gallery up to and including 2.1.4.5 are affected. Authenticated attackers with low privileges can leverage the flaw to include and execute arbitrary local PHP files on the underlying server. Successful exploitation impacts confidentiality, integrity, and availability of the WordPress installation.

Critical Impact
An authenticated attacker can include arbitrary local PHP files, potentially leading to remote code execution, sensitive data disclosure, and full compromise of the WordPress site.

Affected Products

RealMag777 InPost Gallery plugin for WordPress
All versions from initial release through 2.1.4.5
WordPress sites with the inpost-gallery plugin installed and active

Discovery Timeline

2025-09-05 - CVE-2025-57889 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-57889

Vulnerability Analysis

The vulnerability resides in how the InPost Gallery plugin handles filename parameters passed to PHP file inclusion functions. The plugin accepts user-controllable input and forwards it to include or require without proper validation or sanitization. Although the original CWE designation references PHP Remote File Inclusion, the practical exploitation path is Local File Inclusion against files already present on the server. An authenticated attacker can craft a request that resolves to an arbitrary local file path on the WordPress host. When the included file contains PHP, it executes in the context of the web server process. The Exploit Prediction Scoring System rates the likelihood of exploitation at the lower end of the distribution, but the impact remains high once a foothold exists.

Root Cause

The root cause is unsafe handling of a filename argument supplied through a plugin endpoint. The code path passes attacker-influenced input directly to a PHP file inclusion function without enforcing an allowlist, normalizing path separators, or restricting traversal sequences such as ../. This pattern matches [CWE-98] - Improper Control of Filename for Include/Require Statement in PHP Program.

Attack Vector

The attack vector is network-based and requires low-privilege authentication on the target WordPress site. After authenticating, an attacker sends a crafted HTTP request to the vulnerable plugin endpoint with a path parameter pointing to a target file on disk. The plugin includes that file, executing any PHP code it contains. Attackers commonly chain LFI with file upload features or log poisoning to convert local inclusion into remote code execution. Refer to the Patchstack WordPress Vulnerability advisory for additional context.

Detection Methods for CVE-2025-57889

Indicators of Compromise

HTTP requests to InPost Gallery plugin endpoints containing path traversal sequences such as ../ or absolute paths like /etc/passwd or wp-config.php
Unexpected PHP errors in web server logs referencing include() or require() with attacker-controlled paths
New or modified PHP files within wp-content/uploads/ or other writable WordPress directories
Unusual outbound connections from the web server process following plugin interaction

Detection Strategies

Inspect access logs for requests targeting inpost-gallery parameters containing suspicious filename values or encoded traversal sequences
Deploy WordPress integrity monitoring to identify unauthorized changes to plugin and core files
Apply Web Application Firewall (WAF) rules that block known LFI payload patterns against the inpost-gallery plugin paths

Monitoring Recommendations

Centralize WordPress, PHP, and web server logs for correlation and retention
Alert on PHP include/require warnings referencing user-supplied paths or non-plugin directories
Monitor authenticated low-privilege accounts for anomalous activity following login

How to Mitigate CVE-2025-57889

Immediate Actions Required

Inventory all WordPress installations for the inpost-gallery plugin and identify any version at or below 2.1.4.5
Deactivate and remove the InPost Gallery plugin until a fixed version is confirmed available from the vendor
Audit WordPress user accounts and revoke unnecessary contributor or author privileges that could be used for authenticated exploitation
Review web server and PHP error logs for prior signs of file inclusion attempts

Patch Information

At the time of NVD publication, no fixed version beyond 2.1.4.5 is referenced in the available advisory. Administrators should monitor the Patchstack advisory and the official WordPress plugin repository for an updated release addressing CVE-2025-57889.

Workarounds

Disable the InPost Gallery plugin until a patched release is published
Restrict PHP execution in WordPress upload directories using web server configuration
Set allow_url_include = Off and allow_url_fopen = Off in php.ini to reduce inclusion-based exposure
Deploy WAF signatures that block path traversal and file inclusion payloads targeting the plugin

bash

# Example hardening: disable the vulnerable plugin via WP-CLI
wp plugin deactivate inpost-gallery
wp plugin delete inpost-gallery

# Example php.ini hardening to reduce file inclusion risk
# /etc/php/php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"