CVE-2025-24733
📋 TL;DR
This CVE describes a PHP Local File Inclusion vulnerability in the Post Grid Master WordPress plugin. Attackers can exploit improper filename control in include/require statements to read sensitive files on the server. All WordPress sites using Post Grid Master versions up to 3.4.12 are affected.
💻 Affected Systems
- Post Grid Master WordPress Plugin
📦 What is this software?
Post Grid Master by Addonmaster
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise via reading sensitive files like /etc/passwd, wp-config.php, or using PHP wrappers to execute arbitrary code.
Likely Case
Unauthorized access to sensitive server files containing credentials, configuration data, or user information.
If Mitigated
Limited information disclosure if file permissions are properly configured and sensitive files are protected.
🎯 Exploit Status
Exploitation requires minimal technical skill. Public proof-of-concept demonstrates file path traversal to include local files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.4.13 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find Post Grid Master. 4. Click 'Update Now' if update available. 5. If no update available, deactivate and delete plugin, then install fresh version from WordPress repository.
🔧 Temporary Workarounds
Disable Plugin
allTemporarily deactivate Post Grid Master plugin until patched version is available
wp plugin deactivate post-grid-master
Web Application Firewall Rule
linuxBlock requests containing path traversal sequences targeting the vulnerable endpoint
ModSecurity rule: SecRule ARGS "\.\./" "id:1001,phase:2,deny,msg:'Path Traversal Attempt'
🧯 If You Can't Patch
- Remove Post Grid Master plugin completely from all WordPress installations
- Implement strict file permissions (chmod 600) on sensitive configuration files like wp-config.php
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > Post Grid Master version. If version is 3.4.12 or lower, system is vulnerable.Check Version:
wp plugin get post-grid-master --field=versionVerify Fix Applied:
Verify Post Grid Master plugin version is 3.4.13 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing '../' sequences to Post Grid Master endpoints
- Access to sensitive files like wp-config.php from unexpected user agents
Network Indicators:
- Unusual GET/POST requests to /wp-content/plugins/post-grid-master/ with file path parameters
SIEM Query:
source="web_server_logs" AND (uri="*post-grid-master*" AND (uri="*../*" OR uri="*..\\*"))