CVE-2025-32159: Radius Blocks File Inclusion Vulnerability

CVE-2025-32159 Overview

CVE-2025-32159 is a PHP Local File Inclusion (LFI) vulnerability in the RadiusTheme Radius Blocks WordPress plugin. The flaw stems from improper control of filenames in PHP include or require statements [CWE-98]. It affects all versions of Radius Blocks up to and including 2.2.1.

Authenticated attackers with low privileges can include arbitrary local PHP files through the vulnerable plugin. Successful exploitation can lead to code execution, sensitive file disclosure, and full site compromise on affected WordPress installations.

Critical Impact
An authenticated attacker can include and execute local PHP files, leading to remote code execution and full compromise of the WordPress site.

Affected Products

RadiusTheme Radius Blocks WordPress plugin versions up to and including 2.2.1
WordPress sites with the radius-blocks plugin installed and active
All hosting environments running vulnerable plugin versions

Discovery Timeline

2025-04-04 - CVE-2025-32159 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32159

Vulnerability Analysis

The vulnerability is classified as Improper Control of Filename for Include/Require Statement in PHP Program [CWE-98]. The Radius Blocks plugin accepts attacker-influenced input and passes it to a PHP file inclusion function without proper validation or sanitization.

Because the input flows into an include or require call, an attacker can manipulate the path to reference arbitrary local files on the server. PHP then parses and executes any included file as PHP code, regardless of its extension.

The attack requires low-level authenticated access to the WordPress instance. The EPSS score of 1.855% places this issue in the 83rd percentile of vulnerabilities tracked for likely exploitation activity.

Root Cause

The root cause is the absence of strict allowlisting and path normalization on parameters used in PHP file inclusion statements. The plugin trusts a user-controllable value, such as a template, block, or view parameter, to construct a file path. Path traversal sequences and absolute paths are not filtered before the value reaches include or require.

Attack Vector

The attack vector is network-based via HTTP requests to the WordPress site. An authenticated user submits a crafted request to a Radius Blocks endpoint or AJAX handler that processes a file-path parameter.

The attacker supplies a path pointing to a local file such as a log file, an uploaded media file, or a sensitive configuration file. PHP includes the targeted file, executing any PHP code it contains. Refer to the Patchstack advisory for Radius Blocks for additional technical context.

Detection Methods for CVE-2025-32159

Indicators of Compromise

HTTP requests to Radius Blocks endpoints containing path traversal sequences such as ../ or absolute filesystem paths in query or POST parameters
Web server logs showing access to URLs referencing radius-blocks with unusual file-path parameters
PHP error log entries reporting failed include or require calls referencing files outside the plugin directory
Unexpected execution of PHP from upload directories such as wp-content/uploads/

Detection Strategies

Inspect web access logs for requests to plugin endpoints containing ..%2f, ..\, or references to system files like /etc/passwd or wp-config.php
Hunt for authenticated user sessions issuing repeated requests to Radius Blocks AJAX or REST routes with file-path style parameters
Correlate WordPress audit logs with web server logs to identify low-privilege accounts triggering inclusion behavior

Monitoring Recommendations

Enable verbose logging on the WordPress site and forward logs to a centralized SIEM for correlation
Monitor for new PHP files written to wp-content/uploads/ or other writable directories
Alert on outbound network connections from the web server that follow suspicious file inclusion requests

How to Mitigate CVE-2025-32159

Immediate Actions Required

Update the Radius Blocks plugin to a version newer than 2.2.1 as soon as a patched release is available from RadiusTheme
Deactivate and remove the radius-blocks plugin if a patched version is not yet available and the plugin is not business-critical
Audit WordPress user accounts and remove or restrict low-privilege accounts that are not required
Review web server and PHP logs for prior exploitation attempts referencing the plugin

Patch Information

At the time of publication, the Patchstack advisory is the primary reference for fix availability. Administrators should consult the official RadiusTheme plugin page on the WordPress.org repository for the latest released version and apply updates through the WordPress admin interface.

Workarounds

Restrict access to WordPress administrative and authenticated endpoints using a web application firewall (WAF) rule set that blocks path traversal patterns
Configure PHP with open_basedir to limit file inclusion to the WordPress root and plugin directories
Set allow_url_include = Off and allow_url_fopen = Off in php.ini to reduce file inclusion attack surface
Apply least-privilege filesystem permissions so the PHP process cannot read sensitive system files

bash

# Configuration example
# /etc/php/php.ini hardening for WordPress hosts
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"