CVE-2025-24685
Published: 27 January 2025
Summary
CVE-2025-24685 is a high-severity Path Traversal: '.../...//' (CWE-35) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 41.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the path traversal LFI vulnerability by requiring identification, prioritization, testing, and deployment of patches or updates for the vulnerable Morkva UA Shipping plugin up to version 1.0.18.
Prevents exploitation of the '.../...//' path traversal by validating and sanitizing user-supplied inputs used in PHP local file inclusion within the WordPress plugin.
Enforces restrictions on file path inputs to block traversal sequences, limiting inclusion to only authorized local PHP files and directories.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
This is a remote unauthenticated vulnerability in a public-facing WordPress plugin that directly enables exploitation of a public-facing application for initial access, with LFI leading to high-impact code execution on the server.
NVD Description
Path Traversal: '.../...//' vulnerability in Ihor Kit Morkva UA Shipping morkva-ua-shipping allows PHP Local File Inclusion.This issue affects Morkva UA Shipping: from n/a through <= 1.0.18.
Deeper analysisAI
CVE-2025-24685 is a path traversal vulnerability utilizing the '.../...//' sequence in the Morkva UA Shipping WordPress plugin (morkva-ua-shipping), enabling PHP Local File Inclusion. This flaw affects all versions of the plugin from n/a through 1.0.18 and is classified under CWE-35 with a CVSS v3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H).
Unauthenticated attackers can exploit this vulnerability remotely over the network, though it requires high attack complexity and no user interaction. Successful exploitation allows high-impact compromise of confidentiality, integrity, and availability, permitting inclusion and potential execution of arbitrary local PHP files.
The Patchstack advisory (https://patchstack.com/database/Wordpress/Plugin/morkva-ua-shipping/vulnerability/wordpress-morkva-ua-shipping-plugin-1-0-18-local-file-inclusion-vulnerability?_s_id=cve) documents the local file inclusion vulnerability in the Morkva UA Shipping WordPress plugin up to version 1.0.18. Practitioners should consult this reference for detailed mitigation guidance, such as applying available patches or updates.
Details
- CWE(s)