CVE-2025-64360: Consulting Elementor Widgets LFI Vulnerability

CVE-2025-64360 Overview

CVE-2025-64360 is a PHP Local File Inclusion (LFI) vulnerability affecting the Consulting Elementor Widgets plugin developed by StylemixThemes. The vulnerability stems from improper control of filename parameters used in PHP include/require statements, allowing attackers to include arbitrary local files from the server. This can lead to sensitive data exposure, including configuration files, database credentials, and other critical system information.

Critical Impact

Unauthenticated attackers can exploit this vulnerability remotely to read sensitive files from the WordPress server, potentially exposing database credentials, API keys, and other confidential information.

Affected Products

• StylemixThemes Consulting Elementor Widgets versions up to and including 1.4.2
• WordPress installations with the consulting-elementor-widgets plugin active
• Sites running vulnerable versions without proper file access restrictions

Discovery Timeline

• 2025-10-31 - CVE-2025-64360 published to NVD
• 2026-01-20 - Last updated in NVD database

Technical Details for CVE-2025-64360

Vulnerability Analysis

This vulnerability falls under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). The Consulting Elementor Widgets plugin fails to properly sanitize user-controlled input before using it in PHP file inclusion operations. An attacker can manipulate filename parameters to traverse directories and include arbitrary local files from the server's filesystem.

The network-based attack vector means exploitation can occur remotely without requiring any user interaction or authentication. When successfully exploited, attackers gain read access to sensitive files on the server, potentially leading to credential theft, further system compromise, or data breaches.

Root Cause

The root cause lies in insufficient input validation and sanitization of user-supplied filename parameters within the plugin. The vulnerable code accepts user input that is subsequently used in PHP include() or require() statements without properly restricting the file path to safe directories. This allows path traversal sequences (such as ../) to escape the intended directory and access files elsewhere on the filesystem.

Attack Vector

The vulnerability is exploited via network-based requests to the WordPress installation running the vulnerable plugin. Attackers craft malicious requests containing path traversal sequences to include sensitive local files. Common targets include:

• /etc/passwd - System user information
• wp-config.php - WordPress database credentials
• .htaccess files - Server configuration
• Log files containing sensitive information

Since no authentication is required and the attack complexity is low, this vulnerability presents a significant risk to affected WordPress installations. The attack can be performed by sending specially crafted HTTP requests to endpoints exposed by the Consulting Elementor Widgets plugin.

Detection Methods for CVE-2025-64360

Indicators of Compromise

• Unusual HTTP requests containing path traversal sequences (../, ..%2f, ..%252f) targeting the Consulting Elementor Widgets plugin endpoints
• Web server access logs showing repeated requests with file inclusion patterns
• Unexpected file access patterns in PHP logs indicating attempts to read sensitive files
• Error messages in WordPress debug logs related to file inclusion failures

Detection Strategies

• Monitor web application firewall (WAF) logs for path traversal attack patterns targeting WordPress plugin directories
• Implement intrusion detection rules to alert on requests containing ../ sequences in plugin-related parameters
• Audit WordPress plugin installations and verify Consulting Elementor Widgets version is not vulnerable
• Review server access logs for requests targeting consulting-elementor-widgets endpoints with unusual parameters

Monitoring Recommendations

• Enable detailed logging for the WordPress installation to capture all plugin-related requests
• Configure security monitoring tools to alert on file inclusion attack signatures
• Set up file integrity monitoring for critical WordPress configuration files
• Implement real-time alerting for any successful access to sensitive files outside normal operation

How to Mitigate CVE-2025-64360

Immediate Actions Required

• Update the Consulting Elementor Widgets plugin to a patched version above 1.4.2 if available
• If no patch is available, consider temporarily deactivating the consulting-elementor-widgets plugin until a fix is released
• Implement web application firewall (WAF) rules to block path traversal attempts
• Review server logs for any signs of prior exploitation attempts
• Restrict PHP file access permissions to limit the impact of potential LFI attacks

Patch Information

Consult the Patchstack WordPress Plugin Vulnerability Database for the latest patch information and remediation guidance from StylemixThemes. Monitor the WordPress plugin repository for updates to the Consulting Elementor Widgets plugin.

Workarounds

• Implement WAF rules to block requests containing path traversal sequences targeting the plugin
• Use PHP open_basedir directive to restrict file access to the WordPress installation directory
• Consider implementing additional input validation at the web server level using mod_security or similar tools
• Temporarily disable the plugin functionality until a patch is available
• Restrict access to the WordPress admin area to trusted IP addresses

# Example .htaccess rules to block path traversal attempts
<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteCond %{QUERY_STRING} (\.\./|\.\.%2f|\.\.%252f) [NC,OR]
    RewriteCond %{REQUEST_URI} (\.\./|\.\.%2f|\.\.%252f) [NC]
    RewriteRule .* - [F,L]
</IfModule>

# PHP open_basedir restriction (add to php.ini or .user.ini)
# open_basedir = /var/www/html/wordpress:/tmp