CVE-2025-32656

Executive Summary

CVE-2025-32656 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the Testimonial Slider And Showcase Pro WordPress plugin by RadiusTheme. This vulnerability allows an unauthenticated attacker to include arbitrary local files from the server via a PHP include/require statement, leading to potential information disclosure of sensitive files such as /etc/passwd, configuration files, or WordPress wp-config.php. The vulnerability affects all versions up to and including 2.3.15. No patch is currently available, and no public proof-of-concept (PoC) has been released. The CVSS score of 8.1 (High) reflects the ease of exploitation and the potential for significant data exposure.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress plugin repository and third-party marketplaces. Users are advised to monitor for updates from RadiusTheme and consider disabling the plugin until a patch is released. No NPM, PyPI, Go, or Ruby packages are affected.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 8.1 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Sensitive files can be read.
• Integrity Impact: None (I:N) – No file modification.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: High. The vulnerability is trivial to exploit and can lead to full disclosure of server-side secrets, including database credentials and API keys.

Deep Dive & Mechanics

The vulnerability stems from improper control of a filename used in a PHP include or require statement within the plugin. Specifically, the plugin likely passes user-supplied input (e.g., via a GET or POST parameter) directly to a function like include() or require_once() without proper sanitization or validation. This allows an attacker to specify a path to a local file, which is then executed or read by the server.

Root Cause: The plugin fails to validate or restrict the file path parameter, allowing directory traversal sequences (e.g., ../../) to escape the intended directory. This is a classic PHP Local File Inclusion (LFI) vulnerability, categorized under CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program.

Attack Vector: An unauthenticated attacker sends a crafted HTTP request to a vulnerable endpoint, such as:

GET /wp-content/plugins/testimonial-slider-showcase-pro/include.php?file=../../../../etc/passwd HTTP/1.1

The server then includes the specified file, outputting its contents in the response.

Impact: Successful exploitation allows reading of any file on the server that the web server user has access to, including:

• /etc/passwd (user enumeration)
• /etc/shadow (password hashes, if readable)
• /var/www/html/wp-config.php (WordPress database credentials)
• /proc/self/environ (environment variables)
• Application source code

Vulnerable vs. Patched Code

Since no patch is available, the vulnerable code is presumed to be similar to the following pattern:

Vulnerable Code (PHP):

<?php
$file = $_GET['file'];
include($file);
?>

Patched Code (Hypothetical):

<?php
$allowed_files = array('testimonial1.php', 'testimonial2.php');
$file = basename($_GET['file']);
if (in_array($file, $allowed_files)) {
    include($file);
} else {
    die('Invalid file.');
}
?>

The patched version would use a whitelist of allowed files and sanitize the input with basename() to prevent directory traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress instance with Testimonial Slider And Showcase Pro <= 2.3.15 installed and activated.
• Knowledge of the vulnerable endpoint (e.g., /wp-content/plugins/testimonial-slider-showcase-pro/include.php).

Exploitation Steps:

1. Identify the vulnerable parameter (e.g., file, template, page).
2. Craft a request to read /etc/passwd:

   curl -v "http://target.com/wp-content/plugins/testimonial-slider-showcase-pro/include.php?file=../../../../etc/passwd"
   

3. If successful, the response will contain the contents of /etc/passwd.
4. Attempt to read wp-config.php:

   curl -v "http://target.com/wp-content/plugins/testimonial-slider-showcase-pro/include.php?file=../../../../var/www/html/wp-config.php"
   

Note: No public exploit code is available. The above is a generic LFI exploitation technique.

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious GET requests containing ../ or file= parameters.
• Look for requests to plugin files with unusual file paths.
• Use the detection rules provided below.

Mitigation:

• Disable the plugin immediately if no patch is available.
• Implement a Web Application Firewall (WAF) rule to block directory traversal patterns.
• Restrict file permissions on sensitive files (e.g., wp-config.php should be readable only by the web server user).

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests containing ../ or ..\\ in the query string.
  • Requests to /wp-content/plugins/testimonial-slider-showcase-pro/ with parameters like file, template, or include.
  • Outbound connections from the server to unknown IPs (if the attacker exfiltrates data).

• File System IOCs:

  • Unusual entries in web server access logs (e.g., GET /wp-content/plugins/testimonial-slider-showcase-pro/include.php?file=../../../../etc/passwd).
  • Presence of temporary files created by the attacker (e.g., uploaded PHP shells).

• Log IOCs:

  • PHP error logs showing failed include attempts (e.g., PHP Warning: include(): Failed opening '../../../../etc/passwd').

Detection Engineering

YARA Rule

rule CVE_2025_32656_LFI_Detection {
    meta:
        description = "Detects attempts to exploit CVE-2025-32656 LFI in Testimonial Slider And Showcase Pro"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-32656"
    strings:
        $s1 = "testimonial-slider-showcase-pro" nocase
        $s2 = "include.php" nocase
        $s3 = "file=" nocase
        $s4 = "../" nocase
        $s5 = "..\\" nocase
    condition:
        all of ($s1, $s2, $s3) and any of ($s4, $s5)
}

Sigma Rule

title: CVE-2025-32656 LFI Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests attempting to exploit LFI in Testimonial Slider And Showcase Pro
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - 'testimonial-slider-showcase-pro'
            - 'include.php'
            - 'file='
            - '../'
            - '..\\'
    condition: selection
falsepositives:
    - Legitimate use of the plugin with valid file paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32656 LFI Attempt"; flow:to_server,established; content:"testimonial-slider-showcase-pro"; http_uri; content:"include.php"; http_uri; content:"file="; http_uri; pcre:"/(\.\.\/|\.\.\\)/"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin – If the plugin is not critical, deactivate and delete it until a patch is released.
2. Apply virtual patching – Use a WAF to block requests containing ../ or ..\\ in the query string for the plugin's directory.
3. Restrict file permissions – Ensure sensitive files like wp-config.php are not readable by the web server user (e.g., chmod 600).

Long-term Fix:

• Monitor the RadiusTheme website or WordPress plugin repository for an official patch.
• Once patched, update to the latest version immediately.
• Implement input validation and whitelisting for all file inclusion operations in custom code.

Workaround:

• If the plugin must remain active, modify the vulnerable PHP file to add a whitelist check (see patched code example above). However, this may break plugin functionality.

Valters IT
Securing Digital Frontiers