CVE-2025-60218: PT Luxa Addons Path Traversal Flaw

CVE-2025-60218 Overview

CVE-2025-60218 is an arbitrary file upload vulnerability in the PT Luxa Addons plugin for WordPress, affecting all versions up to and including 1.2.2. The flaw allows authenticated users holding only the Subscriber role to upload files of dangerous types to the server. Successful exploitation can lead to remote code execution, full site compromise, and lateral movement into the underlying hosting environment. The issue is tracked under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
An attacker with low-privilege Subscriber access can upload a web shell and execute arbitrary code on the WordPress server.

Affected Products

PT Luxa Addons WordPress plugin versions <= 1.2.2
WordPress sites where the plugin is installed and activated
Subscriber-level (or higher) accounts on impacted sites

Discovery Timeline

2026-06-17 - CVE-2025-60218 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-60218

Vulnerability Analysis

The PT Luxa Addons plugin exposes a file upload handler that fails to restrict the file types accepted from authenticated users. Because the capability check accepts the Subscriber role, an attacker only needs a low-privilege account, which is often obtainable through self-registration on many WordPress sites. The handler writes attacker-supplied content into a web-accessible directory, where it can be requested directly through HTTP.

The scope changes from the vulnerable component to the entire WordPress installation. A successful upload of a PHP payload yields code execution under the web server account, granting access to the database, configuration files, and any other tenant data on the same host.

Root Cause

The root cause is missing or insufficient validation of file extensions, MIME types, and content during the upload routine. The plugin relies on the WordPress authentication layer alone and does not enforce a capability check tight enough to exclude Subscribers. This combination falls squarely under CWE-434.

Attack Vector

An attacker authenticates as a Subscriber, then sends a crafted multipart HTTP request to the plugin's upload endpoint with a malicious file such as a PHP web shell. The server stores the file inside the WordPress uploads directory. The attacker then requests the uploaded file directly, triggering execution and gaining a foothold on the site. See the Patchstack advisory for additional technical context.

Detection Methods for CVE-2025-60218

Indicators of Compromise

New PHP, .phtml, or .phar files appearing under wp-content/uploads/ or PT Luxa Addons-specific upload paths.
HTTP POST requests to plugin upload endpoints originating from accounts with the Subscriber role.
Outbound connections from the www-data or PHP-FPM process to unfamiliar hosts shortly after an upload.
Unexpected creation of new administrator accounts or modifications to wp-config.php.

Detection Strategies

Inspect web server access logs for POST requests to PT Luxa Addons routes followed by GET requests to newly created files in wp-content/uploads/.
File integrity monitoring on the WordPress webroot to flag any non-media file written under the uploads directory.
Static scanning of the uploads directory for PHP tags, eval(, base64_decode(, or system( patterns.

Monitoring Recommendations

Enable WordPress audit logging to capture user registration events and uploads tied to low-privilege accounts.
Forward web server, PHP error, and WordPress logs to a centralized analytics platform for correlation against file-write events.
Alert on first-seen child processes spawned by the PHP interpreter, such as sh, bash, curl, or wget.

How to Mitigate CVE-2025-60218

Immediate Actions Required

Deactivate the PT Luxa Addons plugin until a fixed release is installed.
Audit all Subscriber and higher accounts and remove any unrecognized users.
Search wp-content/uploads/ for executable file types and remove any unauthorized files.
Rotate WordPress secrets in wp-config.php and reset administrator passwords if compromise is suspected.

Patch Information

No fixed version is referenced in the current NVD entry. Monitor the Patchstack advisory and the plugin's WordPress.org page for an updated release beyond 1.2.2, and apply it as soon as it is available.

Workarounds

Disable open user registration, or restrict new registrations to a vetted workflow.
Block execution of PHP within the uploads directory using web server rules.
Place a web application firewall rule in front of the plugin's upload endpoint to reject non-image MIME types.

bash

# Configuration example: deny PHP execution in WordPress uploads (Apache)
<Directory "/var/www/html/wp-content/uploads">
    <FilesMatch "\.(php|phtml|phar|php[0-9]+)$">
        Require all denied
    </FilesMatch>
</Directory>