CVE-2025-32152

Executive Summary

CVE-2025-32152 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the WordPress plugin "Slider a SlidersPack" (sliderspack-all-in-one-image-sliders) by Essential Plugin. The vulnerability stems from improper control of a filename used in a PHP include/require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The plugin is widely used in the WordPress ecosystem, and the vulnerability affects all versions up to and including 2.3. No patch is currently available, and no public proof-of-concept exploit has been released.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed through the official WordPress plugin repository. Users who have installed this plugin from the WordPress dashboard or via direct download are at risk. The plugin is not an NPM, PyPI, Go, or Ruby package, but it is part of the WordPress ecosystem, which relies on plugin integrity. Administrators should verify the plugin's source and consider removing it until a patch is released.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the affected resource are the same.
• Confidentiality (C): High (H) – Full file read access is possible.
• Integrity (I): None (N) – No file modification is possible.
• Availability (A): None (N) – No denial of service.

CVSS Score: 7.5 (High) – The vulnerability allows for significant information disclosure with low attack complexity.

Deep Dive & Mechanics

The vulnerability exists in the sliderspack-all-in-one-image-sliders plugin, specifically in a PHP file that uses an include or require statement with a user-supplied filename without proper sanitization. The vulnerable code likely resembles:

<?php
$file = $_GET['file'];
include($file . '.php');
?>

An attacker can manipulate the file parameter to traverse directories and include arbitrary files. For example, by sending a request like:

http://target.com/wp-content/plugins/sliderspack-all-in-one-image-sliders/vulnerable.php?file=../../../../wp-config

The server would include /var/www/html/wp-config.php (assuming the WordPress root is at /var/www/html). This allows the attacker to read sensitive configuration files, including database credentials, salts, and keys.

The vulnerability is classified as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program), which is a classic PHP LFI. The lack of input validation and the use of user input in a file inclusion function are the root causes.

Vulnerable vs. Patched Code

Vulnerable Code (Example):

<?php
// vulnerable.php
$file = $_GET['file'];
include($file . '.php');
?>

Patched Code (Hypothetical):

<?php
// patched.php
$allowed_files = array('slider1', 'slider2', 'slider3');
$file = $_GET['file'];
if (in_array($file, $allowed_files)) {
    include($file . '.php');
} else {
    // Handle error
    echo 'Invalid file.';
}
?>

The patched version uses a whitelist approach, only allowing predefined filenames. Alternatively, proper input validation using basename() and realpath() could be implemented to prevent directory traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install a local WordPress instance (e.g., using XAMPP or Docker).
2. Install the vulnerable plugin "Slider a SlidersPack" version 2.3.
3. Identify the vulnerable endpoint (e.g., /wp-content/plugins/sliderspack-all-in-one-image-sliders/vulnerable.php).

Exploitation Steps:

1. Use a web browser or tool like curl to send a crafted request:

   curl "http://localhost/wp-content/plugins/sliderspack-all-in-one-image-sliders/vulnerable.php?file=../../../../wp-config"
   

2. The response will contain the contents of wp-config.php, revealing database credentials.
3. For more advanced exploitation, attempt to include log files or other writable files to achieve code execution.

Note: No public exploit code is available, but the technique is standard LFI.

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious file parameters containing ../ or absolute paths.
• Use a Web Application Firewall (WAF) to block requests with directory traversal patterns.
• Implement file integrity monitoring to detect unauthorized changes.

Mitigation:

• Immediately disable or remove the plugin until a patch is released.
• Apply virtual patching via WAF rules to block LFI attempts.
• Restrict file inclusion to a whitelist of allowed files.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests with file parameter containing ../ or ..\ sequences.
  • Requests to /wp-content/plugins/sliderspack-all-in-one-image-sliders/ with unusual parameters.
• File System IOCs:
  • Unexpected inclusion of sensitive files like /etc/passwd or wp-config.php in web server logs.
  • Presence of the vulnerable plugin directory.
• Log IOCs:
  • Web server access logs showing 200 responses to LFI attempts.
  • PHP error logs indicating failed includes or warnings.

Detection Engineering

YARA Rule

rule CVE_2025_32152_LFI_Detection {
    meta:
        description = "Detects attempts to exploit CVE-2025-32152 in Slider a SlidersPack plugin"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-32152"
    strings:
        $s1 = "sliderspack-all-in-one-image-sliders" nocase
        $s2 = "file=" nocase
        $s3 = "../" nocase
        $s4 = "wp-config" nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4)
}

Sigma Rule

title: CVE-2025-32152 LFI Attempt in Slider a SlidersPack
id: 12345678-1234-1234-1234-123456789abc
status: experimental
description: Detects HTTP requests attempting to exploit LFI in the plugin
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'file='
            - '../'
            - 'wp-config'
        cs-uri-stem|contains: 'sliderspack-all-in-one-image-sliders'
    condition: selection
falsepositives:
    - Legitimate use of file parameter (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32152 LFI Attempt in Slider a SlidersPack"; flow:to_server,established; content:"sliderspack-all-in-one-image-sliders"; http_uri; content:"file="; http_uri; content:"../"; http_uri; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or remove the "Slider a SlidersPack" plugin from all WordPress installations until a patched version is released.
2. Virtual Patching: Deploy WAF rules to block requests containing file= with directory traversal patterns (e.g., ../).
3. Code Hardening: If you must keep the plugin, manually edit the vulnerable PHP file to implement a whitelist of allowed files or use basename() and realpath() to sanitize input.
4. Monitoring: Enable detailed logging for web server and PHP errors, and monitor for LFI attempts.
5. Update: Watch the WordPress plugin repository for an official patch and apply it immediately when available.

Valters IT
Securing Digital Frontiers