CVE-2025-52716 in WP REST Cache Plugin
Summary
by MITRE • 08/14/2025
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Acato WP REST Cache allows PHP Local File Inclusion. This issue affects WP REST Cache: from n/a through 2025.1.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 08/31/2026
The identified security flaw resides within the Acato WP REST Cache plugin, specifically affecting versions ranging from no specific lower bound up to version 2025.1.0. This vulnerability is classified as an improper control of filename for include or require statements in PHP programs, commonly referred to as Remote File Inclusion or RFI when involving external sources, but in this context, it manifests as a mechanism that can be leveraged for Local File Inclusion LFI attacks. The core technical issue stems from the application's failure to adequately sanitize and validate user-supplied input before utilizing it within PHP include or require functions. When these language constructs are used with unsanitized variables derived directly from HTTP requests, such as query parameters or POST data, an attacker can manipulate the file path argument passed to the function. This lack of rigorous validation allows for directory traversal sequences or direct specification of arbitrary files on the server's filesystem.
From a technical perspective, PHP's include and require statements are designed to embed the content of one PHP script into another during execution. If the filename parameter is not strictly controlled, an attacker can inject paths that point outside the intended web root or target sensitive system files. While traditional RFI attacks rely on hosting malicious code at a remote URL for inclusion, this specific vulnerability description highlights its potential use in Local File Inclusion scenarios. This typically occurs when the application attempts to include local configuration files, log files, or other internal resources based on user input. By manipulating these inputs, an attacker can read sensitive data such as database credentials stored in wp-config.php, source code of other plugins, or system-level files like etc/passwd if the server environment permits it. The vulnerability is rooted in CWE-98 Improper Control of Filename for Include Statement which categorizes flaws where user input influences file inclusion operations without sufficient validation against a whitelist of expected values.
The operational impact of this vulnerability is severe due to its potential for unauthorized information disclosure and further system compromise. An authenticated attacker, or potentially an unauthenticated one depending on the specific endpoint exposed by WP REST Cache, can exploit this flaw to exfiltrate sensitive data from the WordPress installation. This includes database connection strings that could lead to full database takeover, API keys, and internal application logic. Furthermore, if the server configuration allows for it, reading local files can provide insights into the underlying operating system architecture and installed software, facilitating more advanced attacks such as privilege escalation or lateral movement within a compromised network environment. The attack vector aligns with ATT&CK technique T1083 File and Directory Discovery where adversaries search for sensitive information on affected systems to aid in subsequent phases of an intrusion campaign.
Mitigation strategies must focus on immediate remediation through software updates and robust input validation practices. Administrators should upgrade the Acato WP REST Cache plugin to a version newer than 2025.1.0 as soon as it becomes available, ensuring that the vendor has addressed this specific flaw in their codebase. In cases where an update is not immediately feasible, temporary mitigations include implementing strict allowlists for any file paths used in inclusion statements and disabling remote file includes if they are not required by the application logic. Additionally, web application firewalls can be configured to detect and block requests containing directory traversal patterns or suspicious PHP variable assignments within URL parameters targeting known vulnerable endpoints. Regular security audits and code reviews focusing on how user input interacts with filesystem operations are essential for preventing similar vulnerabilities in future development cycles.