CVE-2025-32156: Just Post Preview File Inclusion Flaw

CVE-2025-32156 Overview

CVE-2025-32156 is a PHP Local File Inclusion (LFI) vulnerability in the Alex Prokopenko / JustCoded Just Post Preview Widget plugin for WordPress. The flaw stems from improper control of filenames used in PHP include or require statements [CWE-98]. Affected versions include Just Post Preview Widget up to and including 1.1.1. Authenticated attackers with low privileges can abuse the vulnerable parameter to include arbitrary local PHP files, leading to code execution within the WordPress process. The Patchstack advisory tracks the issue as a Local File Inclusion vulnerability impacting WordPress sites running the plugin.

Critical Impact
Successful exploitation allows attackers to read sensitive files and execute arbitrary PHP code on the WordPress server, compromising site confidentiality, integrity, and availability.

Affected Products

Alex Prokopenko / JustCoded Just Post Preview Widget plugin for WordPress
All versions from initial release through 1.1.1
WordPress sites with the just-post-preview plugin installed and activated

Discovery Timeline

2025-04-04 - CVE-2025-32156 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32156

Vulnerability Analysis

The Just Post Preview Widget plugin passes attacker-influenced input into a PHP include or require statement without proper validation or sanitization. This pattern, classified under [CWE-98], allows an attacker to control which file the PHP interpreter loads at runtime. When the plugin resolves the supplied path, it executes any PHP code contained in the targeted file within the WordPress request context.

Exploitation requires authentication with low-level privileges, but no user interaction. Attack complexity is elevated because the attacker must reach the vulnerable code path through plugin-specific functionality. Once triggered, the impact extends to confidentiality, integrity, and availability of the WordPress installation.

The EPSS score is 0.959%, placing this issue in the 57th percentile for exploitation likelihood.

Root Cause

The root cause is the use of unsanitized user-supplied input as part of a filename passed to a PHP file inclusion function. The plugin does not enforce an allowlist of permitted files, does not normalize path traversal sequences, and does not constrain inclusion to a specific directory. Any string accepted by the vulnerable handler is treated as a valid path.

Attack Vector

An authenticated attacker sends a crafted request to the plugin endpoint that processes the vulnerable parameter. By supplying a path that resolves to a local PHP file, such as a log file, uploaded asset, or session file with attacker-controlled content, the attacker forces the server to execute arbitrary PHP code. The vulnerability is network-exploitable and does not require user interaction beyond the attacker's own session.

No verified public exploit code is available. Refer to the Patchstack Local File Inclusion Advisory for additional technical context.

Detection Methods for CVE-2025-32156

Indicators of Compromise

HTTP requests to just-post-preview plugin endpoints containing path traversal sequences such as ../ or absolute filesystem paths
Web server access logs showing requests with suspicious file parameters referencing /etc/passwd, wp-config.php, or PHP session files
Unexpected PHP errors referencing include() or require() failures on attacker-supplied paths
New or modified PHP files in the WordPress uploads directory following plugin request activity

Detection Strategies

Inspect WordPress access logs for authenticated requests targeting the just-post-preview plugin with parameter values containing directory traversal patterns
Deploy web application firewall (WAF) rules that flag LFI payloads against WordPress plugin endpoints
Monitor PHP error logs for include or require failures originating from the plugin
Audit installed plugin inventory to confirm whether just-post-preview version 1.1.1 or earlier is present

Monitoring Recommendations

Forward WordPress, Apache, and Nginx logs to a centralized analytics platform for correlation
Alert on access to sensitive files such as wp-config.php, /etc/passwd, and PHP session storage by the web server process
Track file integrity for the WordPress installation directory and uploads folder
Review authenticated user activity for accounts with low privileges performing unusual plugin interactions

How to Mitigate CVE-2025-32156

Immediate Actions Required

Deactivate and remove the Just Post Preview Widget plugin on all WordPress sites where it is installed until a patched version is available
Restrict access to the WordPress admin area using IP allowlists or multi-factor authentication to limit who can reach the authenticated attack surface
Audit user accounts and revoke unnecessary privileges to reduce the population of accounts that meet the authentication requirement
Review recent web server logs for evidence of exploitation attempts against the plugin

Patch Information

No fixed version is identified in the available advisory data. The vulnerability affects Just Post Preview Widget from initial release through version 1.1.1. Consult the Patchstack Local File Inclusion Advisory for updates on a vendor patch. Until a patched release is published, removal of the plugin is the most reliable remediation.

Workarounds

Uninstall the just-post-preview plugin if business requirements do not mandate its use
Deploy a WAF rule to block requests to plugin endpoints containing path traversal sequences or absolute file paths
Apply PHP open_basedir restrictions to limit which directories the WordPress process can include files from
Disable PHP execution within the WordPress uploads directory using web server configuration

bash

# Example Nginx configuration to block PHP execution in uploads
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}

# Example php.ini hardening
open_basedir = "/var/www/html:/tmp"
allow_url_include = Off