WordPress Store Locator Plugin <= 3.98.10 - Lokale Datei-Inklusions-Schwachstelle

The core impact of this Path Traversal vulnerability lies in its ability to enable Local File Inclusion (LFI). An attacker can craft malicious requests that manipulate file paths, bypassing intended security restrictions. This allows them to access and potentially read sensitive files on the server, such as configuration files containing database credentials, application source code, or even system files. Successful exploitation could lead to complete compromise of the WordPress instance and the underlying server. While direct remote code execution might not be immediately apparent, the ability to read sensitive files can be a stepping stone to further attacks, such as injecting malicious code into existing files or leveraging other vulnerabilities.

WordPress websites utilizing the moaluko Store Locator plugin, particularly those running older versions (0.0.0–3.98.10), are at significant risk. Shared hosting environments where multiple websites share the same server resources are especially vulnerable, as a compromise of one site could potentially lead to the compromise of others.

• wordpress / plugin:

wp plugin list --status=inactive | grep store-locator

• wordpress / plugin:

wp plugin update --all

• generic web:

curl -I 'https://your-wordpress-site.com/wp-content/plugins/store-locator/../../../../etc/passwd' # Check for file disclosure

• generic web:

 grep -r "../" /var/log/apache2/access.log # Look for path traversal attempts in logs

1. 2025-01-24Disclosure

   disclosure

1. Reserviert2025-01-16
2. Veröffentlicht2025-01-24
3. Geändert2026-04-28
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2025-23422 is to immediately upgrade the moaluko Store Locator plugin to version 3.98.11 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include restricting file access permissions on the server, implementing a Web Application Firewall (WAF) with rules to block suspicious path traversal attempts (e.g., filtering for '../' sequences), and carefully reviewing the plugin's configuration to ensure no sensitive files are inadvertently exposed. After upgrading, verify the fix by attempting to access files outside the intended directory via the Store Locator plugin’s URL parameters; access should be denied.