CVE-2025-12824
📋 TL;DR
The Player Leaderboard WordPress plugin contains a Local File Inclusion vulnerability that allows authenticated attackers with Contributor-level access or higher to include and execute arbitrary PHP files on the server. This can lead to remote code execution, data theft, and complete system compromise. All WordPress sites using this plugin up to version 1.0.2 are affected.
💻 Affected Systems
- WordPress Player Leaderboard plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Full server compromise with remote code execution, data exfiltration, and persistent backdoor installation leading to complete loss of confidentiality, integrity, and availability.
Likely Case
Unauthorized file access, privilege escalation, and execution of malicious PHP code leading to data theft and website defacement.
If Mitigated
Limited impact with proper file permissions and network segmentation, potentially only allowing local file reading without execution.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once credentials are obtained. The vulnerability is well-documented with public proof-of-concept available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.3 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3416129%40player-leaderboard&new=3416129%40player-leaderboard
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find Player Leaderboard plugin. 4. Click 'Update Now' if update available. 5. If no update available, deactivate and delete plugin, then install fresh version 1.0.3+ from WordPress repository.
🔧 Temporary Workarounds
Remove plugin shortcode usage
allRemove or disable the 'player_leaderboard' shortcode from all posts/pages/widgets
Search WordPress database for '[player_leaderboard' pattern and remove
Restrict user roles
allRemove Contributor and higher privileges from untrusted users
Navigate to Users → All Users in WordPress admin and adjust roles
🧯 If You Can't Patch
- Deactivate and completely remove the Player Leaderboard plugin immediately
- Implement strict file system permissions and disable PHP execution in upload directories
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin → Plugins → Installed Plugins for Player Leaderboard version. If version is 1.0.2 or lower, you are vulnerable.Check Version:
wp plugin list --name=player-leaderboard --field=version (if WP-CLI installed)Verify Fix Applied:
After update, verify plugin version shows 1.0.3 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual include() calls in PHP error logs
- Multiple failed authentication attempts followed by successful login
- Unexpected file access patterns in web server logs
Network Indicators:
- POST requests to WordPress with 'mode' parameter containing path traversal sequences
- Unusual outbound connections from web server
SIEM Query:
web_access_logs WHERE uri CONTAINS 'player_leaderboard' AND (params CONTAINS '../' OR params CONTAINS '..\\' OR params CONTAINS '/etc/' OR params CONTAINS '/proc/')🔗 References
- https://plugins.trac.wordpress.org/browser/player-leaderboard/trunk/public/class-player-leaderboard-public.php#L1419
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3416129%40player-leaderboard&new=3416129%40player-leaderboard
- https://www.wordfence.com/threat-intel/vulnerabilities/id/527f8f08-bab3-4319-99bf-845c8b378c19?source=cve
