EUVD-2025-17528CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3Tags
Description
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in g5theme Essential Real Estate allows PHP Local File Inclusion. This issue affects Essential Real Estate: from n/a through 5.2.1.
Analysis
PHP Local File Inclusion (LFI) vulnerability in g5theme Essential Real Estate plugin versions through 5.2.1, allowing unauthenticated remote attackers to include and execute arbitrary local files on the affected server. The vulnerability stems from improper control of filename parameters in PHP include/require statements (CWE-98), enabling potential information disclosure, code execution, and system compromise. While the CVSS score of 8.1 indicates high severity with high confidentiality and integrity impact, real-world exploitation depends on server configuration, file system permissions, and available local files for inclusion.
Technical Context
This vulnerability exploits improper input validation in PHP file inclusion functions (include(), require(), include_once(), require_once()). The g5theme Essential Real Estate plugin (WordPress theme/plugin component) fails to sanitize user-supplied input before passing it to file inclusion statements, allowing attackers to manipulate the filename parameter to include arbitrary local files from the web server's filesystem. CWE-98 specifically addresses failure to validate/sanitize the path used in include/require statements. This is distinguishable from Remote File Inclusion (RFI) as it targets local files only, but can be equally dangerous depending on the availability of includable files (e.g., log files containing PHP code, uploaded files, configuration files, or source code). The vulnerability affects Essential Real Estate versions from inception through 5.2.1, indicating it has been present across the product's supported lifecycle.
Affected Products
Product: g5theme Essential Real Estate | Vendor: g5theme | Affected Versions: through 5.2.1 (all versions from initial release) | Type: WordPress theme/plugin component | CPE inference: likely wp-content/plugins/essential-real-estate or wp-content/themes/essential-real-estate | Scope: WordPress installations with g5theme Essential Real Estate plugin/theme active. No specific CPE string provided in source data; vendors should cross-reference with g5theme Essential Real Estate advisory documentation. Recommend checking: (1) WordPress plugin repository for Essential Real Estate, (2) g5theme vendor advisory pages, (3) WordPress vulnerability database (WPScan, Exploit-DB) for patch release notes.
Remediation
Immediate Actions: (1) Upgrade g5theme Essential Real Estate to version 5.2.2 or later (assumed patch version; verify with vendor release notes). (2) If immediate patching unavailable: disable the g5theme Essential Real Estate plugin via WordPress admin or deactivate in wp-config.php until patch is applied. (3) Review web server logs and WordPress activity logs for evidence of exploitation (unusual include/require calls, file access patterns). Secondary Measures: (1) Implement Web Application Firewall (WAF) rules to block common LFI payloads (e.g., ../../../, file://, php://, expect://, zip://, glob:// wrappers). (2) Restrict PHP's allow_url_include and allow_url_fopen directives to 'Off' in php.ini if not required for legitimate functionality. (3) Implement principle of least privilege: ensure web server user (www-data, apache) has minimal filesystem permissions. (4) Monitor for configuration drift. Reference vendor advisory from g5theme for official patch distribution and release date. Check WordPress.org plugin security notices and WPScan WordPress Vulnerability Database for confirmation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today