CVE-2025-58608: MediaPress PHP File Inclusion Vulnerability

CVE-2025-58608 Overview

CVE-2025-58608 is a PHP Local File Inclusion (LFI) vulnerability in the BuddyDev MediaPress plugin for WordPress. The flaw stems from improper control of filenames used in PHP include or require statements [CWE-98]. Authenticated attackers can manipulate file path parameters to load arbitrary local PHP files through the plugin's include logic. The vulnerability affects all MediaPress versions up to and including 1.5.9.1. Successful exploitation can disclose sensitive files, enable code execution through includable artifacts, and compromise site integrity.

Critical Impact

Authenticated attackers can include arbitrary local PHP files, potentially leading to information disclosure and code execution within the WordPress environment.

Affected Products

• BuddyDev MediaPress plugin for WordPress
• MediaPress versions through 1.5.9.1
• WordPress sites running vulnerable MediaPress installations

Discovery Timeline

• 2025-09-03 - CVE-2025-58608 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-58608

Vulnerability Analysis

The vulnerability is categorized under [CWE-98] — Improper Control of Filename for Include/Require Statement in PHP Program. MediaPress accepts user-controlled input that flows into a PHP include or require call without sufficient validation or sanitization. An attacker with low-privileged authenticated access can craft requests that direct the plugin to load PHP files from the local filesystem.

Because WordPress plugins execute within the broader application context, the included file runs with the same privileges as the web server process. This means an attacker can read sensitive files (such as wp-config.php) or load PHP files already present on the server to achieve code execution. The EPSS data indicates a low predicted exploitation likelihood at the time of analysis, but the impact remains significant on unpatched sites.

Root Cause

The root cause is missing or insufficient validation of a filename parameter passed to a PHP include directive. The plugin trusts the supplied path and resolves it against the local filesystem. Without enforced allowlists, path normalization, or extension restrictions, the include statement processes attacker-influenced file paths.

Attack Vector

The attack vector is network-based. The attacker must hold a valid low-privileged WordPress account to reach the vulnerable code path. They then submit a crafted request containing a manipulated file path parameter. The plugin includes the targeted file, returning content or executing code embedded in includable artifacts on the host. Refer to the Patchstack MediaPress Vulnerability advisory for additional context on the affected code path.

Detection Methods for CVE-2025-58608

Indicators of Compromise

• Web server access logs showing requests to MediaPress endpoints containing path traversal sequences such as ../ or absolute filesystem paths
• Unexpected reads of sensitive WordPress files including wp-config.php, .htaccess, or files under /etc/
• New or modified PHP files in wp-content/uploads/ followed by requests including those paths
• Anomalous outbound connections originating from the PHP worker process after MediaPress requests

Detection Strategies

• Monitor HTTP requests to MediaPress plugin URLs for parameters containing filesystem path characters, null bytes, or .php references
• Inspect WordPress audit logs for low-privileged accounts triggering MediaPress actions outside normal media workflows
• Correlate plugin request patterns with subsequent file reads or PHP process spawning using endpoint telemetry

Monitoring Recommendations

• Enable verbose logging on the WordPress installation and forward web server logs to a centralized analytics platform
• Alert on authenticated sessions performing unusual sequences of plugin requests with path-like parameters
• Track file integrity for the WordPress root directory and the MediaPress plugin folder to flag unauthorized modifications

How to Mitigate CVE-2025-58608

Immediate Actions Required

• Identify all WordPress sites running BuddyDev MediaPress version 1.5.9.1 or earlier and prioritize them for remediation
• Restrict registration and review existing low-privileged accounts to reduce the pool of potential attackers
• Apply a virtual patch via WAF rules that block path traversal sequences in MediaPress request parameters

Patch Information

No fixed version is referenced in the current CVE record. Review the Patchstack MediaPress Vulnerability advisory for the latest vendor guidance and update to any release later than 1.5.9.1 when available.

Workarounds

• Disable the MediaPress plugin on affected WordPress sites until a fixed version is installed
• Configure PHP open_basedir restrictions to constrain which directories the web server process can read
• Deploy a web application firewall rule that blocks requests containing ../, null bytes, or absolute paths in MediaPress parameters
• Enforce least-privilege filesystem permissions so the web server cannot read sensitive configuration files outside the WordPress document root

# Example PHP hardening in php.ini to limit file inclusion scope
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off
allow_url_fopen = Off