CVE-2025-10686: 
WordPress vulnerability analysis and mitigation

CVE-2025-10686 is a Local File Inclusion (LFI) vulnerability in the Creta Testimonial Showcase WordPress plugin affecting all versions before 1.2.4. It allows authenticated attackers with editor-level access or above to include and execute arbitrary files on the server, enabling execution of arbitrary PHP code. The vulnerability was publicly disclosed on October 24, 2025, and assigned a CVE on November 14, 2025. It carries a CVSS v3.1 base score of 7.2 (High), as assessed by CISA-ADP (WPScan, Red Hat CVE).

The vulnerability is classified as CWE-22 (Improper Limitation of a Pathname to a Restricted Directory — Path Traversal), rooted in insufficient validation of the cretats_layout POST parameter when saving a shortcode post in the WordPress admin panel. An attacker can manipulate this parameter to supply a path traversal sequence (e.g., ../../../../wp-config) that causes the plugin to include an arbitrary file on the server via PHP's include or require mechanism. Because the included file is executed as PHP, any attacker-controlled file containing PHP code (e.g., a previously uploaded web shell) can achieve remote code execution. Exploitation requires editor-level WordPress credentials and the ability to intercept or craft admin POST requests (WPScan).

Successful exploitation grants an attacker the ability to read sensitive server-side files (e.g., wp-config.php containing database credentials), execute arbitrary PHP code, and potentially achieve full server compromise. The confidentiality, integrity, and availability impacts are all rated High, meaning an attacker could exfiltrate credentials, modify site content, install backdoors, or disrupt service. If database credentials from wp-config.php are obtained, lateral movement to the underlying database server is also possible (WPScan, Red Hat CVE).

A proof-of-concept (PoC) is publicly available via WPScan, demonstrating exploitation using directory traversal in the cretats_layout parameter. The EPSS score is approximately 0.087%, indicating a relatively low (but non-zero) probability of exploitation in the wild in the near term. There is no current evidence of active in-the-wild exploitation or threat actor attribution, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog as of the time of this report (WPScan, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Creta Testimonial Showcase plugin version below 1.2.4 using tools like WPScan (wpscan --url http://target.com --enumerate p) or by checking the plugin's readme.txt file at /wp-content/plugins/creta-testimonial-showcase/readme.txt.
2. Obtain Editor-Level Credentials: Acquire valid WordPress credentials with at least editor-level access through phishing, credential stuffing, or other means.
3. Create or Edit a Shortcode Post: Log in to the WordPress admin panel and navigate to http://target.com/wp-admin/edit.php?post_type=cretats_tms_sc to create or edit a Creta Testimonial Showcase shortcode.
4. Intercept and Modify the Save Request: While saving the shortcode post, intercept the HTTP POST request using a proxy tool such as Burp Suite. Locate the cretats_layout parameter in the request body.
5. Inject Path Traversal Payload: Set the cretats_layout parameter value to a path traversal string such as ../../../../wp-config to target wp-config.php, or point to an attacker-controlled PHP file previously uploaded to the server (e.g., via media upload).
6. Trigger File Inclusion: Insert the shortcode into a WordPress page using [cretats_testimonials_sc id="<shortcode_id>"] and load that page. The plugin will attempt to include the specified file, executing any PHP code within it.
7. Achieve Objective: If targeting wp-config.php, observe PHP errors or log output revealing database credentials. If targeting an uploaded PHP web shell, receive command execution output confirming RCE (WPScan).

• Logs: WordPress access logs showing POST requests to /wp-admin/post.php with the cretats_layout parameter containing ../ sequences; PHP error logs showing fatal errors or unexpected file inclusion paths referencing wp-config.php or unusual file paths.
• File System: Presence of unexpected PHP files in the WordPress uploads directory (/wp-content/uploads/) that contain PHP code (potential web shells); modification timestamps on plugin files inconsistent with the installed version.
• Network: Outbound connections from the web server process to unknown external IPs following shortcode page loads, which may indicate a reverse shell being established.
• Process: Unusual child processes spawned by the PHP-FPM or Apache/Nginx worker process (e.g., bash, curl, wget, python) after a page containing the Creta shortcode is loaded (WPScan).

The vendor has released version 1.2.4 of the Creta Testimonial Showcase plugin, which fixes this vulnerability. Site administrators should update the plugin to version 1.2.4 or later immediately via the WordPress admin dashboard (Plugins > Installed Plugins > Update). As a temporary workaround where immediate patching is not possible, restrict editor-level access to trusted users only and consider disabling the plugin until the update can be applied. Additionally, implementing a Web Application Firewall (WAF) rule to block path traversal patterns in POST parameters can provide an additional layer of defense (WPScan).

The vulnerability was discovered and responsibly disclosed by researcher Khaled Alenazi (Nxploited), who also submitted the finding to WPScan. The Wordfence Intelligence weekly WordPress vulnerability report for the week of October 20–26, 2025 included coverage of this issue, indicating it was noted by the broader WordPress security community (Wordfence Blog). No significant vendor statements or widespread social media discussion beyond standard vulnerability aggregator coverage has been observed.