CVE-2025-32150: Real Estate Manager LFI Vulnerability

CVE-2025-32150 Overview

CVE-2025-32150 is a PHP Local File Inclusion (LFI) vulnerability affecting the Rameez Iqbal Real Estate Manager WordPress plugin (real-estate-manager). The flaw stems from improper control of filenames in PHP include or require statements, classified under [CWE-98]. An authenticated attacker can manipulate a file path parameter to include arbitrary local PHP files on the server. The vulnerability affects all versions of Real Estate Manager up to and including 7.3.

Critical Impact
Successful exploitation enables attackers to execute arbitrary PHP code via included local files, leading to full compromise of confidentiality, integrity, and availability on affected WordPress installations.

Affected Products

Rameez Iqbal Real Estate Manager WordPress plugin versions up to and including 7.3
WordPress installations using the real-estate-manager plugin
Hosting environments running vulnerable plugin instances with PHP file include functionality

Discovery Timeline

2025-04-04 - CVE-2025-32150 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32150

Vulnerability Analysis

The vulnerability resides in the Real Estate Manager plugin's handling of file paths passed to PHP include or require statements. The plugin accepts user-controlled input and concatenates it into a file include directive without sufficient validation or sanitization. This allows an attacker with low-privileged authenticated access to traverse directories and load arbitrary .php files present on the server filesystem.

Because PHP executes any code within an included file, an attacker who can write to a predictable file location, upload a log file, or reach session storage, can convert the LFI into remote code execution. The attack complexity is elevated because exploitation requires authenticated access and specific conditions, but the resulting impact spans all three CIA properties.

Root Cause

The root cause is Improper Control of Filename for Include/Require Statement in a PHP Program [CWE-98]. The plugin trusts request-supplied input when constructing the path passed to an include, include_once, require, or require_once statement. Missing allowlisting and missing path normalization permit directory traversal sequences and absolute path references.

Attack Vector

The attack vector is network-based. An authenticated user sends a crafted HTTP request to a vulnerable plugin endpoint, supplying a manipulated filename parameter. The PHP interpreter then resolves and executes the targeted local file. No user interaction is required beyond the attacker's own authenticated session. The flaw is documented in the Patchstack Vulnerability Report.

No verified public exploit code is available. The vulnerability mechanism follows the standard LFI pattern where a parameter such as a template, view, or page name is passed unsanitized into a PHP file include call.

Detection Methods for CVE-2025-32150

Indicators of Compromise

HTTP requests to real-estate-manager plugin endpoints containing directory traversal sequences such as ../, ..%2f, or null byte injections
Requests with parameters referencing sensitive files like /etc/passwd, wp-config.php, or PHP session storage paths
Unexpected PHP execution originating from log files, uploaded media files, or temporary directories
New or modified PHP files in plugin directories not associated with legitimate updates

Detection Strategies

Inspect web server access logs for query strings targeting Real Estate Manager endpoints with file path parameters
Deploy web application firewall (WAF) rules matching path traversal patterns against WordPress requests
Correlate authenticated WordPress user sessions with anomalous PHP include behavior on the host
Run integrity checks against the plugin directory to detect unauthorized file modifications

Monitoring Recommendations

Enable PHP open_basedir logging and review entries that reference files outside expected plugin paths
Monitor outbound connections from the web server process for signs of post-exploitation activity
Alert on creation of new PHP files within wp-content/uploads/ or temporary directories
Track authentication events for accounts performing repeated requests to plugin file-handling endpoints

How to Mitigate CVE-2025-32150

Immediate Actions Required

Identify all WordPress sites running the Real Estate Manager plugin and confirm installed versions
Disable the real-estate-manager plugin on installations running version 7.3 or earlier until a patched release is applied
Rotate WordPress administrative credentials and review account activity for low-privileged accounts that could authenticate to the plugin
Audit the filesystem for unexpected PHP files in upload and cache directories

Patch Information

No fixed version is identified in the published advisory. Refer to the Patchstack Vulnerability Report for the latest vendor guidance and update the plugin to a version newer than 7.3 once released.

Workarounds

Remove or deactivate the Real Estate Manager plugin until a patched version is available
Apply WAF rules that block path traversal sequences in requests directed at WordPress plugin endpoints
Restrict PHP file inclusion using open_basedir and disable_functions directives in php.ini
Enforce least privilege on filesystem permissions to prevent web-writable directories from containing executable PHP

bash

# Example php.ini hardening to restrict file inclusion scope
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off