CVE-2025-24685
Published: 27 January 2025
Description
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Security Summary
CVE-2025-24685 is a path traversal vulnerability utilizing the '.../...//' sequence in the Morkva UA Shipping WordPress plugin (morkva-ua-shipping), enabling PHP Local File Inclusion. This flaw affects all versions of the plugin from n/a through 1.0.18 and is classified under CWE-35 with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability remotely over the network, though it requires high attack complexity and no user interaction. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, permitting inclusion and potential execution of arbitrary local PHP files.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/morkva-ua-shipping/vulnerability/wordpress-morkva-ua-shipping-plugin-1-0-18-local-file-inclusion-vulnerability?_s_id=cve) documents the local file inclusion vulnerability in the Morkva UA Shipping WordPress plugin up to version 1.0.18. Practitioners should consult this reference for detailed mitigation guidance, such as applying available patches or updates.
Details
- CWE(s)
MITRE ATT&CK Enterprise Techniques
Why these techniques?
This is a remote unauthenticated vulnerability in a public-facing WordPress plugin that directly enables exploitation of a public-facing application for initial access, with LFI leading to high-impact code execution on the server.