CVE-2025-32157: Sparkle Elementor Kit LFI Vulnerability

CVE-2025-32157 Overview

CVE-2025-32157 is a PHP Local File Inclusion (LFI) vulnerability in the Sparkle Elementor Kit WordPress plugin developed by Jakub Glos. The flaw stems from improper control of filenames used in include or require statements [CWE-98]. It affects all versions of sparkle-elementor-kit up to and including 2.0.9. An authenticated attacker with low privileges can manipulate file path parameters to load arbitrary local PHP files on the host. Successful exploitation impacts confidentiality, integrity, and availability of the WordPress site.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, leading to information disclosure, code execution through log poisoning, and full compromise of the WordPress instance.

Affected Products

Jakub Glos Sparkle Elementor Kit (sparkle-elementor-kit) versions up to and including 2.0.9
WordPress sites running the vulnerable plugin
Any hosting environment exposing the plugin's vulnerable file inclusion endpoint

Discovery Timeline

2025-04-04 - CVE-2025-32157 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32157

Vulnerability Analysis

The vulnerability resides in how the Sparkle Elementor Kit plugin constructs file paths passed to PHP include or require statements. The plugin accepts user-controlled input and concatenates it into an inclusion path without sufficient sanitization or allow-list validation. Although the advisory classifies the original weakness as PHP Remote File Inclusion, the realized impact is Local File Inclusion because the runtime configuration of typical PHP installations disables remote URL inclusion. An attacker with at least low-privileged authenticated access to the WordPress site can trigger the inclusion logic and traverse the local filesystem.

Root Cause

The root cause is improper control of the filename argument supplied to a PHP file inclusion function [CWE-98]. The plugin does not validate the resolved path against a fixed allow-list of expected templates and does not strip path traversal sequences such as ../. Any string that resolves to a readable .php file on the web server can be executed in the plugin's context.

Attack Vector

The attack vector is network-based and requires low-privileged authentication. An attacker submits a crafted request containing a manipulated filename parameter to a plugin endpoint that performs file inclusion. The PHP interpreter then loads and executes the targeted file. Exploitation paths include reading sensitive configuration files such as wp-config.php, including session files, or chaining with log poisoning to achieve remote code execution. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-32157

Indicators of Compromise

Web server access logs showing requests to Sparkle Elementor Kit endpoints containing ../, encoded traversal sequences (%2e%2e%2f), or absolute paths
Unexpected PHP errors in logs referencing include() or require() calls with unusual file targets
Outbound network connections originating from PHP worker processes shortly after suspicious plugin requests
New or modified PHP files in wp-content/uploads/ that contain executable code

Detection Strategies

Inspect HTTP request parameters sent to sparkle-elementor-kit handlers for path traversal patterns and non-template filenames
Correlate authenticated WordPress user sessions with anomalous plugin parameter values to surface low-privileged accounts probing the endpoint
Monitor PHP open_basedir violations and file access errors as signals of attempted LFI

Monitoring Recommendations

Enable verbose logging on the WordPress application and forward logs to a central analytics platform for query and alerting
Alert on reads of sensitive files such as wp-config.php, /etc/passwd, or PHP session files initiated by the web server user
Track plugin version inventory across hosted WordPress sites to flag installations still running sparkle-elementor-kit 2.0.9 or earlier

How to Mitigate CVE-2025-32157

Immediate Actions Required

Identify all WordPress installations running Sparkle Elementor Kit and confirm the installed version
Disable the plugin on any site running version 2.0.9 or earlier until a patched release is deployed
Rotate WordPress administrator and editor credentials if exploitation is suspected
Review web server and PHP error logs for prior abuse of the inclusion endpoint

Patch Information

At the time of NVD publication, the advisory lists affected versions as n/a through <= 2.0.9. Administrators should consult the Patchstack Vulnerability Report and the plugin's WordPress.org listing for the latest fixed release and upgrade immediately once available.

Workarounds

Deactivate and remove the Sparkle Elementor Kit plugin until a vendor-supplied patch is installed
Deploy a web application firewall rule that blocks path traversal sequences in requests targeting plugin endpoints
Set PHP open_basedir and allow_url_include=Off to limit the filesystem scope available to the plugin
Restrict author and contributor account creation, and audit existing low-privileged accounts for legitimacy

bash

# Configuration example: restrict PHP file inclusion scope
# /etc/php/8.2/fpm/conf.d/99-hardening.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Disable the vulnerable plugin via WP-CLI
wp plugin deactivate sparkle-elementor-kit
wp plugin delete sparkle-elementor-kit