CVE-2025-32153: VG WooCarousel File Inclusion Vulnerability

CVE-2025-32153 Overview

CVE-2025-32153 is a PHP Local File Inclusion (LFI) vulnerability in the vinagecko VG WooCarousel WordPress plugin. The flaw stems from improper control of filename parameters used in PHP include or require statements [CWE-98]. Authenticated attackers can manipulate file path inputs to load arbitrary PHP files from the local filesystem.

The vulnerability affects VG WooCarousel versions from n/a through 1.3. Successful exploitation can lead to disclosure of sensitive configuration data, execution of attacker-controlled PHP files already present on the server, and potential remote code execution depending on the server environment.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, potentially exposing credentials in wp-config.php or escalating to code execution.

Affected Products

vinagecko VG WooCarousel plugin for WordPress
VG WooCarousel versions up to and including 1.3
WordPress sites using the vg-woocarousel plugin

Discovery Timeline

2025-04-04 - CVE CVE-2025-32153 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32153

Vulnerability Analysis

The VG WooCarousel plugin fails to properly validate filename parameters passed to PHP file inclusion functions. The vulnerability is classified under [CWE-98], Improper Control of Filename for Include/Require Statement in PHP Program. While categorized as PHP Remote File Inclusion in the underlying weakness class, the practical impact in this case is Local File Inclusion.

An attacker with low-privileged authenticated access can supply a crafted path value that the plugin passes to include, require, or equivalent PHP functions. The PHP runtime then loads and executes the referenced file in the context of the web server user. The Patchstack advisory describes the issue in the plugin code path responsible for resolving template or partial paths.

The EPSS score for this issue is 0.878% at the 54th percentile, indicating measurable but not widespread exploitation likelihood.

Root Cause

The root cause is missing input validation and sanitization on a parameter that is concatenated into a PHP include/require statement. The plugin does not enforce an allowlist of permitted template files, does not strip directory traversal sequences such as ../, and does not constrain the inclusion to a fixed base directory.

Attack Vector

Exploitation requires network access to the WordPress site and a low-privileged authenticated account. The attacker sends an HTTP request to a vulnerable plugin endpoint with a manipulated path parameter. Because the request must satisfy plugin routing and authentication requirements, attack complexity is high. The attacker can read arbitrary PHP files interpretable by the server, including configuration files, and may chain the LFI with file upload primitives to execute attacker-controlled PHP.

No verified public proof-of-concept code is available. Refer to the Patchstack WordPress Vulnerability Report for advisory details.

Detection Methods for CVE-2025-32153

Indicators of Compromise

HTTP requests to vg-woocarousel plugin endpoints containing directory traversal sequences such as ../ or URL-encoded variants %2e%2e%2f
Web server access logs showing parameter values referencing wp-config.php, /etc/passwd, or PHP wrappers like php://filter
Unexpected PHP errors referencing failed include or require calls within wp-content/plugins/vg-woocarousel/

Detection Strategies

Inspect WordPress access logs for requests to plugin files under /wp-content/plugins/vg-woocarousel/ that contain suspicious path parameters
Deploy web application firewall rules that block traversal patterns and PHP wrapper schemes in query strings and POST bodies
Audit authenticated user activity for low-privileged accounts issuing requests to plugin administrative endpoints

Monitoring Recommendations

Enable PHP error logging and alert on failed opening messages originating from plugin paths
Monitor for new or modified PHP files within wp-content/uploads/ that could serve as inclusion targets
Correlate authentication events with subsequent plugin endpoint requests to identify abuse of low-privileged accounts

How to Mitigate CVE-2025-32153

Immediate Actions Required

Identify all WordPress instances running the VG WooCarousel plugin and confirm version 1.3 or earlier
Deactivate and remove the vg-woocarousel plugin until a fixed version is available
Rotate WordPress secrets, database credentials, and any API keys stored in wp-config.php if exploitation is suspected
Review user accounts and revoke unnecessary low-privileged access used by untrusted parties

Patch Information

No patched version is identified in the available advisory data. The vulnerability affects VG WooCarousel up to and including version 1.3. Consult the Patchstack WordPress Vulnerability Report and the vinagecko vendor channel for the latest release information before re-enabling the plugin.

Workarounds

Remove the plugin directory wp-content/plugins/vg-woocarousel/ from production servers until a fix is published
Restrict access to WordPress administrative and AJAX endpoints to trusted IP ranges using web server ACLs
Configure open_basedir in PHP to constrain file inclusion to the WordPress installation directory
Set allow_url_include = Off and allow_url_fopen = Off in php.ini to reduce inclusion attack surface

bash

# Configuration example: php.ini hardening
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"