WordPress plugin LFI

The WordPress core is usually reasonably patched, but its real surface is in the plugins: third-party code of very uneven quality. A recurring class of bug is Local File Inclusion, where a plugin builds a file path from a request parameter without sanitizing it. The attack flow is to enumerate the plugin version and look up the matching CVE.

wpscan --url http://<ip>/ --enumerate ap     # enumerate plugins and versions
searchsploit '<plugin> <version>'             # find the exploit/CVE

The textbook case is Site-Editor 1.1.1 (CVE-2018-7422): the ajax_path parameter of the ajax_shortcode_pattern.php endpoint is included without validation, so it points to any file on disk:

curl "http://<ip>/wp-content/plugins/site-editor/editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php?ajax_path=/etc/passwd"

An LFI is not just reading /etc/passwd. It serves to leak credentials from config files (wp-config.php, redis.conf, SSH keys, tokens) and, depending on context, can escalate to RCE: including a file the attacker controls (a PHP uploaded or written by another route) makes the web server interpret it, running it under that service's identity.

Nuance. Not every inclusion is pure traversal: sometimes the parameter is concatenated with a prefix or suffix that must be bypassed (php:// wrappers, a null byte on old versions, ../ sequences). And LFI gives read/inclusion, not RCE by itself: execution requires including controlled content.

How to detect it. The access-log signature is a request to a plugin endpoint with a path parameter carrying ../ or an absolute path (ajax_path=/etc/passwd), and the wpscan requests (characteristic User-Agent, rapid enumeration of /wp-content/plugins/*/readme.txt) that usually precede it. A WAF with traversal rules flags it. If it escalates to RCE, the web process (www-data) includes a non-legitimate .php and spawns sh/bash (auditd/Sysmon for Linux). Repeated reads of wp-config.php from a plugin endpoint are the credential-exfiltration indicator.

Defence. Keep plugins updated and minimize how many are installed, validate and normalize any path derived from user input (allowlist, not concatenation) and do not serve sensitive files from the webroot. Related to generic LFI / path traversal, file-upload RCE and credential reuse.