CVE-2025-32304

Executive Summary

CVE-2025-32304 is a critical vulnerability in the WPCHURCH WordPress plugin (church-management) developed by Mojoomla. The flaw is a PHP Local File Inclusion (LFI) vulnerability, stemming from improper control of a filename used in an include/require statement. An unauthenticated attacker can exploit this to read arbitrary files from the server's filesystem, potentially exposing sensitive configuration files, database credentials, or source code. The vulnerability affects all versions up to and including 2.7.0. No patch is currently available, and no public exploit code has been released. The CVSS score of 8.1 (High) reflects the ease of exploitation and the high confidentiality impact.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin, which is part of the broader WordPress ecosystem. The plugin is distributed via the WordPress Plugin Directory and third-party marketplaces. Users are advised to verify the integrity of their plugin files and monitor for updates from the vendor. Since no patch exists, the supply chain risk is elevated, and users should consider disabling the plugin until a fix is released.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No victim action required.
• Scope: Unchanged (S:U) – The vulnerable component and the impacted component are the same.
• Confidentiality Impact: High (C:H) – Full file read capability.
• Integrity Impact: None (I:N) – No file modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can lead to complete disclosure of sensitive server-side data.

Deep Dive & Mechanics

The vulnerability is a PHP Local File Inclusion (LFI) caused by improper sanitization of a filename parameter used in a PHP include() or require() statement. In the WPCHURCH plugin, a parameter (likely file, template, or page) is passed to a function that constructs a file path without proper validation. An attacker can manipulate this parameter to include arbitrary files from the server, such as /etc/passwd, /var/www/html/wp-config.php, or log files.

The attack works by supplying a path traversal sequence (e.g., ../../../../etc/passwd) or using PHP wrappers (e.g., php://filter/convert.base64-encode/resource=wp-config.php) to read files. Since the vulnerability is classified as "PHP Remote File Inclusion" in the description but is actually LFI (as per the CWE), the attack is limited to local files, but this still poses a severe risk.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be something like:

// Vulnerable code (hypothetical)
$file = $_GET['file'];
include( $file . '.php' );

A patched version would validate the file path against a whitelist or use realpath() to restrict access:

// Patched code (hypothetical)
$allowed_files = array('template1', 'template2');
$file = $_GET['file'];
if (in_array($file, $allowed_files)) {
    include( $file . '.php' );
} else {
    // Error handling
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress with WPCHURCH plugin version 2.7.0.
2. Ensure the server is accessible (e.g., http://target/wp-content/plugins/wpchurch/).

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., file, template, page). Common endpoints include:
   • /wp-content/plugins/wpchurch/includes/load.php?file=...
   • /wp-content/plugins/wpchurch/template.php?template=...
2. Use path traversal to read sensitive files:

   http://target/wp-content/plugins/wpchurch/includes/load.php?file=../../../../etc/passwd
   

3. Use PHP wrappers to bypass extension appending:

   http://target/wp-content/plugins/wpchurch/includes/load.php?file=php://filter/convert.base64-encode/resource=wp-config
   

4. Decode the base64 output to retrieve the file contents.

Note: No public exploit code is available, but the above manual technique is standard for LFI.

Blue Team (Defensive)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, ..\\, php://).
• Look for requests to WPCHURCH plugin files with suspicious parameters.
• Use WAF rules to block php:// and file:// wrappers.

Mitigation:

• Disable the WPCHURCH plugin until a patch is released.
• Implement a Web Application Firewall (WAF) with rules to block LFI attempts.
• Restrict file permissions on the server to limit the impact of file reads.

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /var/www/html/wp-config.php, /proc/self/environ
• URL Patterns: ?file=../../, ?template=php://filter/, ?page=..%2f..%2f
• Log Entries: HTTP requests containing ../, ..\\, php://, file:// in query parameters.
• Network Traffic: Outbound connections from the server if the attacker attempts to exfiltrate data.

Detection Engineering

YARA Rule

rule CVE_2025_32304_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting WPCHURCH plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32304"
    strings:
        $path_traversal = /(\.\.\/|\.\.\\){2,}/
        $php_wrapper = /php:\/\//
        $wpchurch_param = /(file|template|page)=/
    condition:
        any of ($path_traversal) and any of ($wpchurch_param) or any of ($php_wrapper) and any of ($wpchurch_param)
}

Sigma Rule

title: CVE-2025-32304 WPCHURCH LFI Attempt
id: 8a3f7c2e-5b1d-4a9f-8c6e-2d3f1a0b9c8e
status: experimental
description: Detects LFI attempts against WPCHURCH plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - '../'
            - '..\\'
            - 'php://'
            - 'file://'
        cs-uri-stem|contains:
            - '/wp-content/plugins/wpchurch/'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32304 WPCHURCH LFI Attempt"; flow:to_server,established; content:"/wp-content/plugins/wpchurch/"; http_uri; pcre:"/(\.\.\/|\.\.\\){2,}|php:\/\/|file:\/\//Ui"; classtype:attempted-recon; sid:10000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WPCHURCH plugin until a patch is released.
2. Implement WAF rules to block path traversal and PHP wrapper attacks.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Apply the vendor patch when available.
• If the plugin is no longer maintained, consider migrating to an alternative church management plugin.
• Conduct a security audit of all WordPress plugins.

Workaround:

• If the plugin must remain active, restrict access to its files via .htaccess:

  <FilesMatch "\.php$">
      Order Deny,Allow
      Deny from all
  </FilesMatch>
  

  (Note: This may break functionality.)

Valters IT
Securing Digital Frontiers