CVE-2025-58024: Accordion FAQ LFI Vulnerability

CVE-2025-58024 Overview

CVE-2025-58024 is a PHP Local File Inclusion (LFI) vulnerability affecting the UnboundStudio Accordion FAQ plugin for WordPress. The flaw stems from improper control of filename parameters used in PHP include or require statements [CWE-98]. Affected versions include all releases up through 2.2.1.

An authenticated attacker with low privileges can manipulate file path parameters to load arbitrary local PHP files from the server. This can lead to code execution, sensitive file disclosure, and full compromise of the WordPress installation.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, potentially leading to remote code execution and complete compromise of the WordPress site.

Affected Products

UnboundStudio Accordion FAQ WordPress plugin (also known as PressApps Accordion FAQ)
All versions from initial release through 2.2.1
WordPress sites running the vulnerable plugin

Discovery Timeline

2026-06-02 - CVE-2025-58024 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2025-58024

Vulnerability Analysis

The vulnerability resides in how the Accordion FAQ plugin handles user-controlled input passed to PHP file inclusion functions. The plugin fails to validate or sanitize filename parameters before passing them to include, require, include_once, or require_once calls. This allows an attacker to control which file the PHP interpreter loads and executes.

Local File Inclusion in PHP applications enables an attacker to load files already present on the server. If the attacker can write attacker-controlled content into any readable file, such as log files, session files, or uploaded media, the included file will be executed as PHP code in the context of the web server.

The issue is classified under [CWE-98], Improper Control of Filename for Include/Require Statement in PHP Program. Exploitation requires authenticated access with low privileges and a higher attack complexity, but successful exploitation impacts confidentiality, integrity, and availability.

Root Cause

The plugin accepts a filename or path parameter from an HTTP request and concatenates it into a PHP inclusion statement without enforcing an allow-list of permitted files. Path normalization and traversal sequences are not filtered, enabling references to files outside the plugin directory.

Attack Vector

The vulnerability is exploitable over the network against any WordPress site with the plugin installed and active. The attacker authenticates with a low-privileged account, then issues a crafted request that manipulates the vulnerable inclusion parameter. By pointing the parameter at server-side files containing attacker-controlled data, the adversary forces PHP execution of that content.

The vulnerability mechanism is described in the Patchstack Vulnerability Report. No public proof-of-concept exploit is currently available.

Detection Methods for CVE-2025-58024

Indicators of Compromise

HTTP requests to Accordion FAQ plugin endpoints containing path traversal sequences such as ../ or null bytes in query parameters
Web server access logs showing requests with file parameters referencing /etc/passwd, wp-config.php, or PHP session and log file paths
Unexpected PHP execution originating from wp-content/plugins/pressapps-accordion-faq/ paths
Creation of new PHP files or web shells inside the WordPress uploads or plugin directories

Detection Strategies

Inspect web server and WordPress logs for unusual parameter values referencing absolute paths or directory traversal patterns targeting Accordion FAQ endpoints
Deploy a Web Application Firewall (WAF) rule set that flags LFI patterns in requests to /wp-admin/admin-ajax.php and plugin-specific URLs
Monitor outbound child processes spawned by the PHP-FPM or web server user, especially shell interpreters or network utilities

Monitoring Recommendations

Enable verbose request logging on the WordPress reverse proxy and retain logs for forensic review
Alert on integrity changes to PHP files within the plugin directory and the WordPress core
Track authentication events for low-privileged WordPress accounts that suddenly access plugin administrative endpoints

How to Mitigate CVE-2025-58024

Immediate Actions Required

Identify all WordPress sites running UnboundStudio (PressApps) Accordion FAQ version 2.2.1 or earlier
Disable or remove the plugin until a vendor patch is applied if a fixed version is not yet installed
Audit WordPress user accounts and revoke unnecessary low-privileged access that could be abused to authenticate against the vulnerable endpoint
Review recent web server logs for signs of exploitation attempts predating remediation

Patch Information

At the time of publication, the Patchstack advisory lists all versions through 2.2.1 as affected. Administrators should monitor the WordPress plugin repository and vendor channels for an updated release that addresses the LFI flaw and apply it immediately upon availability.

Workarounds

Deactivate and delete the Accordion FAQ plugin until a fixed version is available
Deploy WAF rules that block path traversal sequences and absolute file paths in requests targeting plugin parameters
Harden PHP configuration by setting open_basedir to restrict file inclusion to the WordPress installation directory and disabling allow_url_include
Apply the principle of least privilege to WordPress accounts, reducing the number of users who can authenticate against plugin endpoints

bash

# Example php.ini hardening to restrict file inclusion scope
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"