CVE-2025-32209: Nomupay Payment Gateway Path Traversal Flaw

CVE-2025-32209 Overview

CVE-2025-32209 is a path traversal vulnerability in the Nomupay Payment Processing Gateway plugin (totalprocessing-card-payments) for WooCommerce. The flaw affects all plugin versions up to and including 7.1.5. An authenticated attacker with low privileges can abuse improperly sanitized path parameters to read arbitrary files from the WordPress host over the network. The weakness is tracked as CWE-22, Improper Limitation of a Pathname to a Restricted Directory. Patchstack classifies the issue as an arbitrary file download vulnerability in the WooCommerce integration.

Critical Impact
An authenticated attacker can download arbitrary files from the WordPress server, including configuration files such as wp-config.php that expose database credentials and secret keys.

Affected Products

Nomupay Payment Processing Gateway (totalprocessing-card-payments) WordPress plugin
All versions from initial release through 7.1.5
WooCommerce stores using the Total Processing Card Payments integration

Discovery Timeline

2025-04-10 - CVE-2025-32209 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32209

Vulnerability Analysis

The plugin exposes functionality that accepts a user-supplied path or filename parameter and uses it to read or stream file contents back to the requester. Because the code does not canonicalize the path or constrain it to an expected base directory, an attacker can inject traversal sequences such as ../ to escape the intended directory. The request requires authentication at a low privilege level, which aligns with the typical WooCommerce customer or subscriber role. Successful exploitation yields read access to any file the PHP process can access, with no impact to integrity or availability.

Root Cause

The root cause is missing input validation on a file path parameter handled by the plugin. The code accepts attacker-controlled input and concatenates it into a filesystem path without rejecting traversal metacharacters or resolving the final path against an allowlisted directory. This pattern maps directly to CWE-22.

Attack Vector

The attack is delivered over the network through a crafted HTTP request to the vulnerable plugin endpoint. The attacker authenticates with low privileges, then supplies a path parameter containing traversal sequences to reference files outside the intended directory. Targeted files commonly include wp-config.php, .htaccess, backup archives, and private key material. Refer to the Patchstack Vulnerability Advisory for the vendor-coordinated technical write-up.

No verified public proof-of-concept code is available at this time, so exploitation details are described in prose rather than as runnable code.

Detection Methods for CVE-2025-32209

Indicators of Compromise

HTTP requests to totalprocessing-card-payments plugin endpoints containing ../, ..%2f, or URL-encoded traversal sequences in path parameters
Outbound responses from the WordPress server containing contents of wp-config.php, /etc/passwd, or other sensitive files
Access log entries showing authenticated users requesting file paths that do not correspond to normal checkout or payment flows

Detection Strategies

Inspect web server and WordPress access logs for requests to plugin routes with path parameters containing dot-dot sequences or encoded variants
Deploy WAF rules that flag traversal patterns targeting plugin query parameters and POST bodies
Correlate low-privilege account activity against file-download endpoints to surface anomalous read behavior

Monitoring Recommendations

Alert on repeated 200-response file downloads following requests from subscriber or customer roles
Monitor for new or modified administrator accounts created shortly after suspected file-disclosure activity, which can indicate credential reuse from leaked wp-config.php secrets
Track plugin version inventory across WordPress hosts to confirm all instances are above 7.1.5

How to Mitigate CVE-2025-32209

Immediate Actions Required

Upgrade the Nomupay Payment Processing Gateway plugin to a release later than 7.1.5 as soon as the vendor publishes a fixed version
Rotate WordPress secret keys in wp-config.php, database credentials, and any API keys that were readable by the web server
Audit WordPress user accounts and remove unused low-privilege accounts that could be abused to meet the authentication requirement

Patch Information

Consult the Patchstack Vulnerability Advisory for the current fixed version and vendor remediation guidance. Verify the installed plugin version through the WordPress admin dashboard under Plugins and confirm it is above 7.1.5.

Workarounds

Disable and remove the totalprocessing-card-payments plugin until a patched release is installed
Restrict access to WordPress plugin endpoints with a web application firewall rule that blocks traversal sequences in query parameters
Set strict filesystem permissions so the PHP process cannot read sensitive files outside the WordPress document root

bash

# Example WAF rule concept (ModSecurity) to block traversal in plugin requests
SecRule REQUEST_URI "@contains totalprocessing-card-payments" \
  "chain,id:1032209,phase:2,deny,status:403,log,msg:'CVE-2025-32209 path traversal attempt'"
  SecRule ARGS "@rx (\.\./|\.\.%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"