CVE-2025-32657

Executive Summary

CVE-2025-32657 is a critical PHP Local File Inclusion (LFI) vulnerability affecting the Testimonial Slider And Showcase Pro WordPress plugin by RadiusTheme, versions up to and including 2.1.7. The vulnerability stems from improper control of filenames used in PHP include/require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading /etc/passwd, wp-config.php, or other configuration files containing database credentials. The CVSS score is 7.5 (High), and no patch is currently available. As this is a WordPress plugin, the attack surface is broad, affecting any site running the vulnerable plugin.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the WordPress Plugin Directory and commercial marketplaces. Since no patch exists, the supply chain risk is elevated: any site using this plugin is exposed. Users should treat the plugin as compromised and remove it until a fix is issued.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – exploitable remotely.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – impact confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – full file read possible.
• Integrity Impact: None (I:N) – no file modification.
• Availability Impact: None (A:N) – no denial of service.

Threat Level: High. The combination of network exploitability, no authentication, and high confidentiality impact makes this a serious risk for WordPress sites.

Deep Dive & Mechanics

The vulnerability exists in the testimonial-slider-showcase-pro plugin. The plugin likely uses a PHP include or require statement with a user-controllable parameter (e.g., page, file, or template) without proper sanitization. An attacker can manipulate this parameter to include arbitrary files from the server.

Root Cause: The plugin fails to validate or sanitize the filename passed to include(). For example, a vulnerable code snippet might look like:

include($_GET['template'] . '.php');

An attacker can use path traversal (../) to escape the intended directory and include sensitive files.

Exploitation Scenario:

1. Attacker identifies a vulnerable endpoint, e.g., wp-content/plugins/testimonial-slider-showcase-pro/template.php?file=.
2. Attacker sends a request: ?file=../../../../etc/passwd%00 (null byte injection may be needed for older PHP versions) or ?file=../../../../wp-config.php.
3. The server includes the file, outputting its contents in the response.

Impact: Full read access to server files, including WordPress configuration (database credentials, salts), system files, and other sensitive data.

Vulnerable vs. Patched Code

Since no patch exists, we can only describe the vulnerable pattern and a hypothetical fix.

Vulnerable Code (Hypothetical):

<?php
$file = $_GET['file'];
include( $file . '.php' );
?>

Patched Code (Hypothetical):

<?php
$allowed_files = array('template1', 'template2');
$file = $_GET['file'];
if (in_array($file, $allowed_files)) {
    include( $file . '.php' );
} else {
    // Error handling
}
?>

A proper fix would use a whitelist of allowed files, validate the path, and avoid user input in include statements.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A WordPress site with Testimonial Slider And Showcase Pro <= 2.1.7 installed and activated.
• Knowledge of the vulnerable parameter (likely file, page, or template).

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a web fuzzer (e.g., ffuf) to find parameters that cause LFI. Common patterns: ?file=, ?page=, ?template=.
2. Test for LFI: Send a request to include a known file:

   curl "http://target.com/wp-content/plugins/testimonial-slider-showcase-pro/some-page.php?file=../../../../etc/passwd"
   

3. Read sensitive files: If successful, read wp-config.php:

   curl "http://target.com/wp-content/plugins/testimonial-slider-showcase-pro/some-page.php?file=../../../../wp-config"
   

   (Note: The .php extension may be appended automatically; try without extension or use null byte %00 for older PHP.)

Lab Setup:

• Use a local WordPress installation with the vulnerable plugin.
• Set up a simple PHP server: php -S 0.0.0.0:8080 -t /path/to/wordpress
• Test with the above curl commands.

Blue Team (Defensive)

Detection:

• Monitor web server logs for path traversal patterns (e.g., ../, %2e%2e%2f).
• Look for requests to plugin files with suspicious parameters.
• Use WAF rules to block LFI attempts.

Hunting:

• Search for requests containing testimonial-slider-showcase-pro and file= or page= parameters.
• Check for outbound connections from the web server to unknown IPs (data exfiltration).

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/testimonial-slider-showcase-pro/ (any file within this directory)
• URL Patterns: ?file=, ?page=, ?template= with path traversal sequences
• Log Entries: HTTP requests with ../ or %2e%2e%2f in the query string
• Response Content: Contents of /etc/passwd, wp-config.php, or other sensitive files in HTTP responses
• Network: Unusual outbound traffic from the web server (if attacker exfiltrates data)

Detection Engineering

YARA Rule

rule CVE_2025_32657_LFI_Testimonial_Slider {
    meta:
        description = "Detects LFI attempts against Testimonial Slider And Showcase Pro"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-32657"
    strings:
        $path_traversal = /\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c/
        $plugin_path = "testimonial-slider-showcase-pro"
        $param_file = "file="
        $param_page = "page="
        $param_template = "template="
    condition:
        $plugin_path and ($path_traversal) and ($param_file or $param_page or $param_template)
}

Sigma Rule

title: CVE-2025-32657 LFI Attempt Against Testimonial Slider And Showcase Pro
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests attempting LFI via the vulnerable plugin
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'testimonial-slider-showcase-pro'
            - 'file='
            - 'page='
            - 'template='
        cs-uri-query|re: '\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c'
    condition: selection
falsepositives:
    - Legitimate use of similar parameters in other plugins
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32657 LFI Attempt - Testimonial Slider And Showcase Pro"; flow:to_server,established; content:"testimonial-slider-showcase-pro"; http_uri; content:"file="; http_uri; pcre:"/\.\.\/|\.\.\\|%2e%2e%2f|%2e%2e%5c/Ui"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable the plugin: Deactivate and delete the Testimonial Slider And Showcase Pro plugin from all WordPress installations.
2. Check for compromise: Review server logs for LFI attempts and inspect wp-config.php for unauthorized changes.
3. Rotate credentials: If wp-config.php was exposed, change database passwords, salts, and any other secrets.

Long-term Mitigation:

• Vendor patch: Monitor RadiusTheme for an official patch. Apply it immediately when released.
• WAF rules: Deploy a Web Application Firewall (e.g., ModSecurity) with rules to block path traversal.
• File permissions: Ensure sensitive files (e.g., wp-config.php) are not readable by the web server user.
• PHP configuration: Disable allow_url_include and allow_url_fopen if not needed.
• Alternative plugin: Replace with a similar, actively maintained plugin.

Valters IT Signature:
This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.