CVE-2025-32288

Executive Summary

CVE-2025-32288 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the RT-Theme 18 | Extensions plugin (slug: rt18-extensions) for WordPress, developed by stmcan. The vulnerability stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The CVSS v3.1 base score is 7.5 (High), with the attack vector being network-based, requiring no authentication, and no user interaction. The affected version is 2.4 and below, and no official patch has been released at this time.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Users who have installed the rt18-extensions plugin are at risk. Since the plugin is part of the WordPress ecosystem, supply chain risks include compromised updates or malicious forks. Administrators should verify the integrity of the plugin files and monitor for any suspicious modifications.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low (L) – No special conditions or complex steps are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – The victim does not need to perform any action.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Sensitive files can be read.
• Integrity (I): None (N) – No file modification is possible via this vector alone.
• Availability (A): None (N) – No denial of service impact.

Threat Level: High. The ease of exploitation and potential for sensitive data exposure make this a priority for remediation.

Deep Dive & Mechanics

The vulnerability exists in the rt18-extensions plugin, likely in a PHP file that handles dynamic file inclusion based on user-supplied input. The plugin may use a parameter (e.g., page, file, or template) to include a PHP file for rendering. Without proper sanitization, an attacker can supply path traversal sequences (e.g., ../../) to include arbitrary files from the server.

Example vulnerable code pattern:

$file = $_GET['file'];
include($file . '.php');

An attacker could request:

http://target.com/wp-content/plugins/rt18-extensions/vuln.php?file=../../../../wp-config

This would include /var/www/html/wp-config.php (assuming the base path), exposing database credentials.

The plugin is a WordPress component, so the attack surface is the WordPress installation itself. The vulnerability is not related to Apache or Nginx misconfigurations.

Vulnerable vs. Patched Code

Vulnerable Code (hypothetical):

<?php
$page = $_GET['page'];
include(plugin_dir_path(__FILE__) . 'pages/' . $page . '.php');
?>

Patched Code (recommended):

<?php
$allowed_pages = array('home', 'about', 'contact');
$page = $_GET['page'];
if (in_array($page, $allowed_pages)) {
    include(plugin_dir_path(__FILE__) . 'pages/' . $page . '.php');
} else {
    // Handle error
    wp_die('Invalid page.');
}
?>

The patched version uses a whitelist approach to restrict included files to a predefined set, preventing path traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with rt18-extensions version <= 2.4 installed and activated.
• Knowledge of the vulnerable endpoint (e.g., /wp-content/plugins/rt18-extensions/includes/load.php?file=).

Exploitation Steps:

1. Identify the vulnerable parameter by reviewing the plugin source code or using fuzzing.
2. Craft a request to read sensitive files:

   GET /wp-content/plugins/rt18-extensions/includes/load.php?file=../../../../wp-config HTTP/1.1
   Host: target.com
   

3. If the server returns the file contents, the vulnerability is confirmed.
4. For potential RCE, if file upload is possible (e.g., via media library), upload a PHP shell and include it:

   GET /wp-content/plugins/rt18-extensions/includes/load.php?file=../../../../wp-content/uploads/2025/04/shell HTTP/1.1
   

No exploit code was provided in the hacker intel.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing ../ or ..%2f in parameters related to rt18-extensions.
• Look for unusual file inclusion patterns, such as attempts to read /etc/passwd or wp-config.php.

Hunting:

• Search for requests to /wp-content/plugins/rt18-extensions/ with suspicious query strings.
• Use the Sigma rule below to detect path traversal attempts.

Containment:

• Immediately disable the rt18-extensions plugin if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Restrict file permissions on sensitive files like wp-config.php.

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/rt18-extensions/ (any file within this directory)
• URL Patterns: ?file=../../, ?page=../../, ?template=../../
• Log Entries: HTTP requests with 200 OK responses to LFI attempts, especially for files like wp-config.php, /etc/passwd, or ../../../../etc/passwd.
• Network Indicators: Outbound connections from the web server to unknown IPs if RCE is achieved.

Detection Engineering

YARA Rule

rule CVE_2025_32288_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting RT-Theme 18 Extensions plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32288"
    strings:
        $path1 = "rt18-extensions"
        $path2 = "file="
        $path3 = "../"
        $path4 = "..%2f"
    condition:
        all of ($path*) and #path3 > 1
}

Sigma Rule

title: CVE-2025-32288 LFI Attempt on RT-Theme 18 Extensions
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in requests to rt18-extensions plugin
author: Valters IT
date: 2025/04/10
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'rt18-extensions'
            - 'file='
            - 'page='
            - 'template='
        cs-uri-query|re: '\.\.\/|\.\.%2f'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in admin area (rare)
level: high

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2025-32288 LFI Attempt on RT-Theme 18 Extensions";
    flow:to_server,established;
    content:"rt18-extensions"; http_uri;
    content:"file="; http_uri;
    pcre:"/(\.\.\/|\.\.%2f)/Ri";
    classtype:attempted-recon;
    sid:10000001;
    rev:1;
    reference:cve,2025-32288;
)

Remediation & Mitigation

1. Immediate Action: Disable the rt18-extensions plugin until a patch is released.
2. Patch: Monitor the plugin's official page for updates. If no patch is available, consider removing the plugin entirely.
3. WAF Rules: Deploy virtual patching via WAF to block requests containing ../ or ..%2f in parameters associated with the plugin.
4. File Permissions: Ensure wp-config.php and other sensitive files are not readable by the web server user (e.g., chmod 600).
5. Code Review: If you have access to the source code, implement input validation using a whitelist of allowed files.
6. Monitoring: Enable detailed logging for all requests to the plugin directory and alert on suspicious patterns.

Valters IT
Securing Digital Frontiers