CVE-2025-25174·PHP vulnerability
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in beeteam368 BeeTeam368 Extensions beeteam368-extensions allows PHP Local File Inclusion.This issue affects BeeTeam368 Extensions: from n/a through <= 1.9.4.
- Severity
- critical
- Software
- PHP
- Published
How likely is exploitation
FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at <0.1% — higher than 21% of all published CVEs. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.
Read the two together. CVE-2025-25174 scores 10 on CVSS, so a successful attack would be serious — but at <0.1%, almost nobody is currently attempting it. That is a different situation from a flaw under mass exploitation, and it is usually the difference between patching on your next maintenance window and patching tonight.
How to fix this CVE
Remove or update the BeeTeam368 Extensions plugin immediately. If the plugin must remain, restrict file upload capabilities and implement WAF rules to block LFI patterns. Audit the WordPress installation for signs of compromise including web shells and backdoor files.
# Remove the plugin:
wp plugin deactivate beeteam368-extensions --path=/var/www/html
wp plugin delete beeteam368-extensions --path=/var/www/html
# Or update to patched version if available:
wp plugin update beeteam368-extensions --path=/var/www/html
# Scan for web shells:
find /var/www -name '*.php' -exec grep -l 'eval(\|base64_decode(\|system(' {} \;Defensia detects this vulnerability
What an exploitation attempt looks like
Sample log line indicative of exploitation attempts:
GET /wp-content/plugins/beeteam368-extensions/includes/template.php?file=../../../wp-config.php HTTP/1.1
The attacker manipulates file path parameters to include arbitrary PHP files. By traversing to wp-config.php, they extract database credentials. By including uploaded files or log files with injected PHP code, they achieve code execution.WAF mitigation (if patching is not yet possible)
Add this rule to your WAF to block exploitation attempts while you schedule the patch.
SecRule ARGS "@rx (?:\.\.[\/\\]){2,}" "id:20252517,phase:2,deny,status:403,msg:'CVE-2025-25174 LFI path traversal blocked',severity:CRITICAL,tag:'CVE-2025-25174'"
SecRule REQUEST_URI "beeteam368" "id:20252518,phase:1,chain"
SecRule ARGS "@rx (?:etc/passwd|wp-config|proc/self)" "deny,status:403,msg:'LFI targeting sensitive files via BeeTeam368'"How to check if you are affected
- Check if BeeTeam368 Extensions is installed: wp plugin list --path=/var/www/html | grep beeteam368
- Check plugin version: cat /var/www/html/wp-content/plugins/beeteam368-extensions/readme.txt | grep 'Stable tag'
- Search access logs for LFI attempts: grep -E 'beeteam368.*\.\./' /var/log/apache2/access.log
- Scan for web shells: find /var/www -name '*.php' -exec grep -l 'eval(base64_decode' {} \;
- Check wp-config.php access time: stat /var/www/html/wp-config.php
Indicators of compromise
- HTTP requests to beeteam368-extensions paths with ../ sequences
- Access to wp-config.php via plugin file inclusion
- New PHP files in wp-content/uploads/ or wp-content/plugins/
- Unexpected database queries from the WordPress application
- Outbound connections from the web server to unknown IPs
FAQ
What is the BeeTeam368 Extensions plugin?
It is a WordPress plugin that provides various theme extensions and functionality. It is not as widely known as major plugins but is used on sites running BeeTeam368 themes.
Why is this CVSS 10.0?
Maximum CVSS score because: network-accessible (AV:N), no complexity (AC:L), no privileges required (PR:N), no user interaction (UI:N), and complete compromise of confidentiality, integrity, and availability (C:H/I:H/A:H) with scope change (S:C).
Can this be exploited without uploading files?
Yes. LFI can include existing files like wp-config.php (credential disclosure), /etc/passwd (user enumeration), or log files that contain attacker-injected PHP code (log poisoning for RCE).
How do I check if my site was compromised?
Search for web shells: find /var/www -name '*.php' -newer /var/www/html/wp-config.php -mtime -90. Check access logs for beeteam368 requests with path traversal. Review database for unauthorized admin users.
Is deactivating the plugin sufficient?
Deactivating prevents new exploitation but does not remove the vulnerable files. You must delete the plugin entirely. Also audit for compromise — if already exploited, the attacker may have planted backdoors elsewhere.
Related PHP CVEs
References
Track CVEs across your fleet automatically
Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2025-25174. Free for 1 server.
Get started free