CVE-2025-32142 Overview
CVE-2025-32142 is a PHP Local File Inclusion (LFI) vulnerability in the Stylemix Motors motors-car-dealership-classified-listings WordPress plugin. The flaw affects all versions up to and including 1.4.71. The plugin fails to properly control filenames used in PHP include/require statements, classified under [CWE-98]. An authenticated attacker with low privileges can supply crafted input to load arbitrary local PHP files on the server. Successful exploitation enables code execution within the WordPress process, disclosure of sensitive files, and full compromise of site integrity. The vulnerability carries a network attack vector and impacts confidentiality, integrity, and availability.
Critical Impact
Authenticated attackers can include arbitrary local PHP files, leading to remote code execution on WordPress sites running the Motors plugin.
Affected Products
- Stylemix Motors motors-car-dealership-classified-listings plugin for WordPress
- All plugin versions from initial release through 1.4.71
- WordPress sites using the Motors car dealership and classified listings theme stack
Discovery Timeline
- 2025-04-04 - CVE-2025-32142 published to the National Vulnerability Database
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-32142
Vulnerability Analysis
The Motors plugin processes user-controlled input and passes it into a PHP include or require statement without adequate validation. Because PHP resolves these statements against the local filesystem, an attacker can manipulate the parameter to traverse directories and load arbitrary .php files already present on the host. Any included file is executed in the context of the WordPress PHP worker. This grants the attacker the same privileges as the web server user. The attacker requires only low-privileged authentication to reach the vulnerable code path, which is exposed over the network.
Root Cause
The root cause is improper control of a filename parameter passed to a dynamic include statement, mapped to [CWE-98]. The plugin neither restricts the path to an allowlist of expected templates nor sanitizes traversal sequences. Any user-supplied string flows directly into the file resolution logic.
Attack Vector
Exploitation is remote and authenticated. An attacker submits an HTTP request to a Motors plugin endpoint with a manipulated parameter referencing a local file path. The plugin includes that file, executing its PHP contents. Attackers commonly chain LFI with log poisoning, session file abuse, or uploaded media to achieve remote code execution. See the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-32142
Indicators of Compromise
- HTTP requests to Motors plugin endpoints containing path traversal sequences such as ../, ..%2f, or absolute paths like /etc/passwd.
- Web server logs showing PHP errors referencing include() or require() failures with unexpected file paths.
- Unexpected outbound connections or new PHP files written under wp-content/uploads/ shortly after suspicious plugin requests.
- Access patterns from low-privileged WordPress accounts hitting plugin endpoints not normally used by their role.
Detection Strategies
- Inspect WordPress and web server access logs for plugin URLs combined with file path parameters containing traversal or null-byte tokens.
- Deploy a web application firewall rule that flags include-style parameters resolving outside the plugin directory.
- Monitor PHP error logs for failed to open stream and include(): Failed opening entries referencing the Motors plugin.
Monitoring Recommendations
- Alert on creation of new PHP files within wp-content/uploads/ or other writable directories.
- Track authentication events for low-privileged accounts that subsequently issue plugin requests with file-path parameters.
- Correlate plugin request patterns with outbound network activity from the web server to identify post-exploitation behavior.
How to Mitigate CVE-2025-32142
Immediate Actions Required
- Update the Motors plugin to a version later than 1.4.71 as soon as the vendor releases a fixed build.
- Audit WordPress user accounts and revoke unnecessary low-privileged accounts that could be abused for authenticated exploitation.
- Review web server, PHP, and WordPress logs for prior exploitation attempts referencing local file paths.
Patch Information
Stylemix has been notified through the Patchstack disclosure program. Administrators should consult the Patchstack Vulnerability Report and the official Stylemix changelog for the patched release. Apply the fixed version across all WordPress instances running the plugin.
Workarounds
- Disable and remove the Motors plugin until a patched version is installed and verified.
- Restrict access to plugin endpoints with a web application firewall rule blocking traversal sequences and absolute paths in query parameters.
- Harden PHP by setting open_basedir to limit file access to the WordPress document root and required directories.
- Set allow_url_include = Off and allow_url_fopen = Off in php.ini to prevent remote include escalation paths.
# Example php.ini hardening to limit file inclusion impact
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off
allow_url_fopen = Off
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
