CVE-2025-66115 Overview
CVE-2025-66115 is a Local File Inclusion (LFI) vulnerability in the MatrixAddons Easy Invoice plugin for WordPress. The flaw stems from improper control of filenames used in PHP include/require statements, classified under [CWE-98]. All versions of Easy Invoice up to and including 2.1.4 are affected. An attacker with high privileges on the target site can abuse the vulnerable include path to load arbitrary local PHP files, leading to information disclosure or server-side code execution through included content.
Critical Impact
Successful exploitation allows an authenticated attacker to include arbitrary local files, compromising confidentiality, integrity, and availability of the WordPress host.
Affected Products
- MatrixAddons Easy Invoice WordPress plugin, versions through 2.1.4
- WordPress installations with the easy-invoice plugin enabled
- Shared hosting environments running vulnerable Easy Invoice deployments
Discovery Timeline
- 2025-11-21 - CVE-2025-66115 published to the National Vulnerability Database
- 2026-10-18 - Last updated in NVD database
Technical Details for CVE-2025-66115
Vulnerability Analysis
The Easy Invoice plugin passes attacker-influenced input into a PHP file inclusion statement without sufficient validation. PHP evaluates any included file as code, so a successful LFI primitive can expose configuration files such as wp-config.php or execute PHP payloads that reach the include path. The weakness is categorized as PHP Remote File Inclusion per [CWE-98], although in this instance exploitation is scoped to local files. The Exploit Prediction Scoring System currently ranks this issue at the lower end of likely-to-be-exploited vulnerabilities, but authenticated administrators of multisite or multi-tenant WordPress environments remain a realistic abuse path.
Root Cause
The plugin constructs a path argument that flows into a PHP include, include_once, require, or require_once call without a strict allowlist or canonicalization check. Because the filename is not constrained to a safe directory, path traversal sequences and arbitrary absolute paths can resolve to sensitive files on disk.
Attack Vector
Exploitation requires network access to the WordPress site and high-privilege authentication. An attacker submits a crafted parameter to the vulnerable Easy Invoice endpoint that references a local file. PHP then interprets the referenced file, which may yield credential disclosure from configuration files or code execution when combined with log poisoning, uploaded media, or session-based file write primitives. See the Patchstack Local File Inclusion Vulnerability advisory for the technical reference.
Detection Methods for CVE-2025-66115
Indicators of Compromise
- Web server access logs showing requests to Easy Invoice endpoints containing ../, ..%2f, or absolute paths such as /etc/passwd or wp-config.php.
- Unexpected PHP errors referencing include() or require() failures tied to the easy-invoice plugin directory.
- Outbound requests or file reads originating from the WordPress PHP worker process targeting sensitive system paths.
Detection Strategies
- Inspect WordPress and web server logs for parameter values that end in .php, .log, .ini, or contain traversal sequences when calling Easy Invoice routes.
- Deploy web application firewall rules that reject path traversal patterns and absolute filesystem paths in query strings or POST bodies for /wp-admin/admin.php and plugin AJAX endpoints.
- Correlate newly authenticated administrator sessions with subsequent file inclusion attempts targeting the plugin.
Monitoring Recommendations
- Enable PHP error logging and alert on failed to open stream entries referencing the plugin path.
- Monitor file integrity of wp-config.php, .htaccess, and plugin files for unauthorized read patterns or modifications.
- Track administrative account creation and privilege changes that could precede exploitation attempts.
How to Mitigate CVE-2025-66115
Immediate Actions Required
- Audit all WordPress sites for the easy-invoice plugin at versions 2.1.4 or earlier and deactivate where possible until a patch is applied.
- Rotate WordPress salts, database credentials, and any secrets stored in wp-config.php if exploitation is suspected.
- Restrict administrator access and enforce multi-factor authentication to reduce the pool of accounts that could trigger the vulnerable code path.
Patch Information
No fixed version is listed in the available advisory data. Monitor the Patchstack advisory and the plugin's WordPress.org changelog for an official release that supersedes 2.1.4, and apply it as soon as it becomes available.
Workarounds
- Remove or disable the Easy Invoice plugin until a vendor-supplied fix is published.
- Apply virtual patching through a WordPress firewall service that blocks LFI payloads targeting the plugin's endpoints.
- Harden PHP by setting open_basedir to the WordPress document root to constrain file inclusion scope.
# Configuration example: restrict PHP file access via open_basedir
# Add to php.ini or a per-site pool configuration
open_basedir = "/var/www/html/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
allow_url_include = Off
allow_url_fopen = Off
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
