CVE-2025-28979: 
WordPress vulnerability analysis and mitigation

CVE-2025-28979 is a Local File Inclusion (LFI) vulnerability in the ThimPress WP Pipes WordPress plugin, classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It affects WP Pipes versions up to and including 1.4.3, and was reported by researcher LVT-tholv2k on June 5, 2025, with Patchstack publishing the advisory on July 22, 2025, and NVD publishing on August 14, 2025. The vulnerability carries a CVSS v3.1 base score of 9.8 (Critical) per NVD, and 8.1 (High) per Patchstack's scoring (Patchstack, Red Hat CVE).

The root cause is improper control of filename parameters used in PHP include/require statements within the WP Pipes plugin (CWE-98), which allows an attacker to manipulate file path inputs to include arbitrary local files on the server. Because no authentication is required and the attack complexity is low, a remote unauthenticated attacker can send a crafted network request to trigger the inclusion of sensitive local files. The vulnerability is classified under OWASP Top 10 A3: Injection and is associated with CAPEC-193 (PHP Remote File Inclusion) (Patchstack, Red Hat CVE).

Successful exploitation allows an unauthenticated remote attacker to include and execute arbitrary local files on the WordPress server, potentially exposing sensitive configuration files such as wp-config.php (which contains database credentials), enabling complete database takeover, and facilitating arbitrary PHP code execution. The high confidentiality, integrity, and availability impact scores reflect the potential for full compromise of the WordPress installation and the underlying server. There is no scope change, but lateral movement within the hosting environment is plausible if database or system credentials are exposed (Patchstack).

As of the time of disclosure, there is no public proof-of-concept exploit and no confirmed evidence of in-the-wild exploitation (Red Hat CVE). The EPSS score is approximately 0.0015 (0.15%), indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, Patchstack notes that vulnerabilities of this class are frequently used in mass-exploit campaigns targeting WordPress sites at scale, regardless of site popularity (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WP Pipes plugin (version ≤ 1.4.3) using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata at /wp-content/plugins/wp-pipes/readme.txt.
2. Identify vulnerable parameter: Analyze the plugin's PHP source code or public disclosures to locate the endpoint or parameter that passes user-controlled input to a PHP include/require statement without adequate sanitization.
3. Craft malicious request: Construct an HTTP request (GET or POST) to the vulnerable endpoint, supplying a manipulated filename parameter pointing to a sensitive local file (e.g., ../../../../wp-config.php or /etc/passwd) using path traversal sequences.
4. Retrieve sensitive data: Submit the crafted request to the target server; if successful, the server will include and output the contents of the targeted file, exposing credentials or other sensitive information.
5. Escalate access: Use exposed database credentials from wp-config.php to access the WordPress database directly, create admin accounts, or pivot to further compromise the hosting environment (Patchstack).

• Network: Unusual HTTP requests to WP Pipes plugin endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in parameter values; repeated requests from a single IP targeting plugin-specific URLs.
• Logs: WordPress or web server access logs showing requests with encoded or raw path traversal strings in query parameters; HTTP 200 responses to requests that include file path patterns referencing system files (e.g., /etc/passwd, wp-config.php).
• File System: Unexpected new files (e.g., web shells) in the WordPress uploads or plugin directories; modification timestamps on core WordPress files that do not align with legitimate updates.
• Process: Unusual PHP processes spawning child processes (e.g., bash, curl, wget) from the web server user account (Patchstack).

No official patch from ThimPress was available as of the Patchstack advisory (July 22, 2025); administrators should check for an updated version beyond 1.4.3 and upgrade immediately if available. If no patch exists, the recommended action is to disable or remove the WP Pipes plugin until a fix is released. Patchstack has issued a virtual patching/mitigation rule for its subscribers to block exploitation attempts in the interim. Additional mitigations include deploying a Web Application Firewall (WAF) with rules targeting LFI patterns, restricting plugin access via IP whitelisting where feasible, and monitoring server logs for suspicious file inclusion patterns (Patchstack).

Wordfence included CVE-2025-28979 in its weekly WordPress vulnerability report for July 21–27, 2025, highlighting it as part of broader WordPress plugin security coverage (Wordfence Blog). Patchstack, which coordinated the disclosure, emphasized the mass-exploit campaign risk associated with unauthenticated LFI vulnerabilities in WordPress plugins and issued a virtual patch for its users (Patchstack). No significant broader media coverage or notable researcher commentary beyond these sources has been identified.