CVE-2025-32155: Beds24 Online Booking LFI Vulnerability

CVE-2025-32155 Overview

CVE-2025-32155 is a PHP Local File Inclusion (LFI) vulnerability in the Beds24 Online Booking WordPress plugin by markkinchin. The flaw stems from improper control of filenames used in include or require statements [CWE-98]. Authenticated attackers can manipulate file path parameters to include arbitrary local PHP files on the server. The issue affects all plugin versions up to and including 2.0.28. Successful exploitation can lead to disclosure of sensitive files, execution of arbitrary PHP code, and full compromise of the hosting environment.

Critical Impact
Authenticated attackers can include arbitrary local files through the Beds24 Online Booking plugin, potentially executing PHP code and accessing sensitive WordPress configuration data.

Affected Products

Beds24 Online Booking WordPress plugin versions through 2.0.28
WordPress installations running the beds24-online-booking plugin
Hosting environments where the vulnerable plugin is active

Discovery Timeline

2025-04-04 - CVE-2025-32155 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32155

Vulnerability Analysis

The vulnerability is a PHP Local File Inclusion issue categorized under [CWE-98]. The Beds24 Online Booking plugin accepts a user-controlled value that is passed into a PHP include or require statement without sufficient validation. Attackers with low-privileged authenticated access can supply crafted input that traverses the filesystem and loads unintended PHP files. When malicious or sensitive PHP files are included, the server executes their contents in the context of the WordPress process. This results in confidentiality, integrity, and availability impact on the affected host.

Root Cause

The root cause is missing or inadequate sanitization of a filename parameter consumed by a PHP file inclusion function. The plugin trusts request input to construct a file path. Path traversal sequences and absolute paths are not stripped before the include operation occurs.

Attack Vector

The attack vector is network-based and requires authentication with low privileges. An attacker submits a crafted request to a vulnerable plugin endpoint, supplying a path that resolves to a sensitive local file. The PHP interpreter loads and executes the referenced file. Refer to the Patchstack Vulnerability Report for additional technical context.

No verified public proof-of-concept code is currently available for this CVE.

Detection Methods for CVE-2025-32155

Indicators of Compromise

HTTP requests to Beds24 plugin endpoints containing path traversal sequences such as ../ or absolute filesystem paths
Unexpected access to sensitive PHP files such as wp-config.php or files under /etc/ via web request logs
New or modified PHP files appearing in the WordPress uploads directory after plugin-related activity

Detection Strategies

Inspect web server access logs for parameters containing file path patterns directed at beds24-online-booking URLs
Apply WordPress audit logging to capture authenticated user actions targeting plugin endpoints
Correlate authenticated user sessions with anomalous file read or include behavior on the PHP application layer

Monitoring Recommendations

Monitor file integrity on WordPress core, plugin, and theme directories for unauthorized changes
Alert on outbound connections originating from the PHP process to uncommon destinations
Track plugin version inventory across hosted WordPress sites to identify vulnerable installations of beds24-online-booking 2.0.28 or earlier

How to Mitigate CVE-2025-32155

Immediate Actions Required

Identify all WordPress sites running the Beds24 Online Booking plugin and confirm installed versions
Update the plugin to a release later than 2.0.28 once a patched version is available from the vendor
Restrict administrative and contributor-level access to trusted accounts only, since exploitation requires authentication
Review web server and WordPress logs for prior exploitation attempts targeting the plugin

Patch Information

At the time of publication, the Beds24 Online Booking plugin is affected through version 2.0.28. Administrators should consult the Patchstack Vulnerability Report and the WordPress plugin repository for the latest fixed release.

Workarounds

Deactivate and remove the Beds24 Online Booking plugin until a patched version is installed
Deploy a web application firewall rule blocking path traversal patterns in requests to plugin endpoints
Enforce least-privilege on WordPress user roles to reduce the pool of accounts capable of triggering the vulnerable code path

bash

# Configuration example: WAF rule concept blocking traversal in plugin requests
# (Pseudocode - adapt to your WAF syntax)
SecRule REQUEST_URI "@contains /wp-content/plugins/beds24-online-booking/" \
  "chain,deny,status:403,id:1003215,msg:'Block LFI attempt against Beds24 plugin'"
  SecRule ARGS "@rx (\.\./|/etc/|wp-config\.php)" "t:none,t:urlDecode"