Improper Control of Filename for Include/Require Statement in PHP Program

CVE-2025-22305 is a local file inclusion flaw in the WordPress hero-banner-ultimate plugin from Essential Plugin / WP OnlineSupport. The CVE record says affected versions run through 1.4.2, while Patchstack, Wordfence, WPScan, and Rapid7 all extend exposure through 1.4.4 and point to 1.4.5 as the fix; that version-range mismatch is the main intel wrinkle here. In practical terms, an authenticated user with at least Author-level access can steer the plugin into including local files, which can expose sensitive application files and, in some server/file-upload configurations, turn into code execution.

The vendor's 6.5 MEDIUM score is technically defensible in a lab, but too generous for enterprise patch triage. The decisive reality check is attacker position: this is not unauthenticated internet RCE, it is a post-login, role-gated flaw in a small-footprint WordPress plugin with no KEV listing, tiny EPSS, and no credible in-the-wild exploitation evidence. That combination pushes this down to LOW for most defenders managing broad estate risk.

Why this verdict

• Requires prior auth: PR:L here is not a footnote; it means the attacker already has a WordPress foothold and at least Author rights.
• Exposure population is small: WPScan showed roughly 1,000 active installs, which is tiny compared with mass-targeted WordPress plugins.
• No active-exploitation pressure: no KEV entry, no credible public campaign reporting, and the supplied EPSS is extremely low at 0.00242.

Why not higher?

If this were unauthenticated or broadly deployed, the include/require bug class would justify a much louder response. But the chain compounds downward: niche plugin, prior login required, role-gated access, and no strong evidence of widespread weaponization.

Why not lower?

It still should not be ignored because local file inclusion against a live CMS can expose wp-config.php, database credentials, auth salts, and application secrets. In some deployments the same primitive can be pushed further toward code execution, so there is real per-site impact once the attacker is inside.

1. Restrict WordPress author roles — Audit who actually holds Author-or-higher rights on sites using this plugin, and remove or downgrade unnecessary accounts. Because the verdict is LOW, there is no SLA (treat as backlog hygiene) for mitigation, but this is still worth folding into normal IAM cleanup before the remediation window closes.
2. Enforce MFA on WordPress admin and author logins — This directly attacks the most important prerequisite in the exploit chain: valid Author+ credentials. For a LOW finding there is no formal mitigation deadline, but if the site is business-critical you should close this auth gap during the same maintenance cycle rather than waiting for the final patch deadline.
3. Monitor for LFI-style requests in authenticated areas — Add detections for traversal-like path input, weird file references, and post-auth requests touching plugin endpoints. There is no mitigation SLA for LOW, so treat this as hygiene telemetry that improves your odds of spotting exploitation before patching lands.
4. Remove or replace abandoned plugin instances — The WordPress.org page says the plugin was permanently closed on 2026-04-07, which raises lifecycle risk beyond this one CVE. Even when severity is LOW, dead plugins are bad long-term inventory; remove or replace them as part of routine CMS hardening before the remediation deadline.

Run this on the target WordPress host or on a configuration-management worker with filesystem access to the site. Invoke it as bash check_hero_banner_ultimate_cve_2025_22305.sh /var/www/html and use an account that can read the plugin directory; root is not required unless your webroot permissions are locked down.

#!/usr/bin/env bash
# check_hero_banner_ultimate_cve_2025_22305.sh
# Detects whether the Hero Banner Ultimate WordPress plugin is in a version range
# commonly reported as vulnerable to CVE-2025-22305.
#
# Usage:
#   bash check_hero_banner_ultimate_cve_2025_22305.sh /path/to/wordpress
#
# Exit codes:
#   0 = PATCHED
#   1 = VULNERABLE
#   2 = UNKNOWN

set -u

WP_ROOT="${1:-}"
PLUGIN_DIR=""
VERSION=""

if [[ -z "$WP_ROOT" ]]; then
  echo "UNKNOWN - missing WordPress root path argument"
  exit 2
fi

PLUGIN_DIR="$WP_ROOT/wp-content/plugins/hero-banner-ultimate"
MAIN_FILE="$PLUGIN_DIR/hero-banner-ultimate.php"
README_FILE="$PLUGIN_DIR/readme.txt"

if [[ ! -d "$PLUGIN_DIR" ]]; then
  echo "UNKNOWN - plugin directory not found: $PLUGIN_DIR"
  exit 2
fi

extract_version() {
  local f="$1"
  if [[ -f "$f" ]]; then
    awk -F': *' '
      BEGIN{IGNORECASE=1}
      /^Version:/ {print $2; exit}
      /^Stable tag:/ {print $2; exit}
    ' "$f" | tr -d '\r'
  fi
}

VERSION="$(extract_version "$MAIN_FILE")"
if [[ -z "$VERSION" ]]; then
  VERSION="$(extract_version "$README_FILE")"
fi

if [[ -z "$VERSION" ]]; then
  echo "UNKNOWN - could not determine plugin version from $MAIN_FILE or $README_FILE"
  exit 2
fi

# Source intelligence conflict exists between <=1.4.2 and <=1.4.4.
# This checker uses the broader consensus from Patchstack/Wordfence/WPScan/Rapid7:
# vulnerable through 1.4.4, fixed in 1.4.5.

verlte() {
  # returns success if $1 <= $2
  [[ "$1" == "$2" ]] && return 0
  local first
  first=$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)
  [[ "$first" == "$1" ]]
}

vergte() {
  # returns success if $1 >= $2
  [[ "$1" == "$2" ]] && return 0
  local first
  first=$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)
  [[ "$first" == "$2" ]]
}

if verlte "$VERSION" "1.4.4"; then
  echo "VULNERABLE - Hero Banner Ultimate version $VERSION detected (treat <=1.4.4 as vulnerable)"
  exit 1
fi

if vergte "$VERSION" "1.4.5"; then
  echo "PATCHED - Hero Banner Ultimate version $VERSION detected"
  exit 0
fi

echo "UNKNOWN - version $VERSION did not map cleanly to expected ranges"
exit 2

Sources

1. OpenCVE mirror of the CVE record
2. Patchstack advisory
3. Wordfence advisory
4. WPScan plugin vulnerability page
5. WordPress.org plugin page
6. Rapid7 vulnerability entry
7. FIRST EPSS data/statistics
8. CISA Known Exploited Vulnerabilities Catalog