CVE-2025-58973 Overview
CVE-2025-58973 is a Local File Inclusion (LFI) vulnerability in the hashthemes Easy Elementor Addons plugin for WordPress. The flaw exists in versions through 2.2.8 and stems from improper control of filenames used in PHP include/require statements [CWE-98]. Authenticated attackers with low privileges can manipulate file path parameters to include arbitrary local PHP files on the server. Successful exploitation can lead to disclosure of sensitive configuration data, execution of attacker-controlled PHP within included files, and full compromise of confidentiality, integrity, and availability of the affected WordPress site.
Critical Impact
An authenticated attacker can include arbitrary local PHP files through the vulnerable plugin, potentially leading to remote code execution and full site compromise.
Affected Products
- hashthemes Easy Elementor Addons plugin for WordPress
- All versions from initial release through and including 2.2.8
- WordPress sites running the vulnerable plugin with authenticated low-privilege user access
Discovery Timeline
- 2025-09-22 - CVE-2025-58973 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-58973
Vulnerability Analysis
The vulnerability is classified under [CWE-98] (Improper Control of Filename for Include/Require Statement in PHP Program). The Easy Elementor Addons plugin accepts user-supplied input that is passed into a PHP include or require statement without sufficient validation or sanitization. While the advisory categorizes the issue as PHP Remote File Inclusion in CWE terminology, the practical impact is Local File Inclusion (LFI) against the WordPress server hosting the plugin.
The attack requires network access and authenticated low-privilege credentials. Exploitation complexity is elevated because attackers must satisfy specific conditions to trigger the vulnerable code path, but successful exploitation yields high impact across confidentiality, integrity, and availability.
Root Cause
The root cause is the use of unsanitized user input as part of a filename argument to a PHP file inclusion function. When the plugin constructs a path for include, require, include_once, or require_once, it fails to enforce an allowlist of expected files or to canonicalize the path against a restricted base directory. This allows directory traversal sequences or absolute paths to redirect the inclusion to files outside the intended scope.
Attack Vector
An authenticated attacker submits a crafted request containing a manipulated file path parameter to a plugin endpoint that performs file inclusion. By traversing the filesystem with sequences such as ../ or supplying a path to an attacker-uploaded file (for example, a media upload containing PHP payload data), the attacker forces the server to execute or expose arbitrary local files. Targeted files commonly include wp-config.php, log files, or uploaded content that can be coerced into PHP execution.
No public proof-of-concept exploit code is available at the time of publication. Refer to the Patchstack WordPress Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-58973
Indicators of Compromise
- HTTP requests to Easy Elementor Addons plugin endpoints containing directory traversal sequences such as ../, ..%2f, or encoded null bytes in query parameters.
- Web server access log entries showing authenticated users requesting plugin URLs with file path parameters referencing system files like wp-config.php, /etc/passwd, or PHP session files.
- Unexpected PHP errors in server logs referencing include() or require() failures with attacker-controlled paths.
Detection Strategies
- Inspect WordPress access logs for requests targeting /wp-content/plugins/easy-elementor-addons/ with suspicious path-like parameters.
- Deploy a web application firewall (WAF) rule that blocks LFI patterns including path traversal sequences and references to sensitive system files in plugin query strings.
- Audit the WordPress uploads directory and active plugin code for newly created PHP files or webshells that may follow successful inclusion of attacker-uploaded content.
Monitoring Recommendations
- Enable PHP error logging and forward logs to a centralized SIEM to correlate failed inclusion attempts with authenticated user sessions.
- Monitor low-privilege WordPress accounts (Subscriber, Contributor) for anomalous activity targeting plugin endpoints, since the vulnerability requires authentication.
- Track file integrity on the WordPress installation, alerting on modifications to wp-config.php, theme files, and uploaded media that suddenly contain PHP code.
How to Mitigate CVE-2025-58973
Immediate Actions Required
- Identify all WordPress installations running Easy Elementor Addons at version 2.2.8 or earlier and treat them as vulnerable.
- Disable or remove the plugin until a patched version is installed if business workflows permit.
- Review WordPress user accounts and revoke or audit low-privilege accounts that are no longer required, reducing the authenticated attack surface.
Patch Information
At the time of publication, the Patchstack advisory indicates the vulnerability affects Easy Elementor Addons versions up to and including 2.2.8. Site administrators should consult the Patchstack WordPress Vulnerability Report and the official plugin repository for the most recent fixed release, then upgrade immediately.
Workarounds
- Deploy WAF rules that block path traversal payloads and restrict file inclusion patterns in HTTP parameters targeting the plugin path.
- Apply PHP-level hardening by setting open_basedir in php.ini to restrict file access to the WordPress document root and required directories.
- Restrict registration and reduce assigned capabilities for low-trust roles to limit the pool of accounts able to reach the vulnerable endpoint.
# Configuration example: restrict PHP file access via open_basedir in php.ini
open_basedir = "/var/www/html/wordpress:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
allow_url_include = Off
allow_url_fopen = Off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
