CVE-2025-32549: WPGYM Path Traversal Vulnerability

CVE-2025-32549 Overview

CVE-2025-32549 is a PHP Local File Inclusion (LFI) vulnerability affecting the mojoomla WPGYM gym management plugin for WordPress. The flaw resides in improper control of filenames used in PHP include or require statements, classified as [CWE-98]. Authenticated attackers with low privileges can manipulate file path parameters to include arbitrary local PHP files on the server. Successful exploitation can lead to information disclosure, code execution through log poisoning, or full site compromise. The vulnerability impacts all WPGYM versions from initial release through 65.0.

Critical Impact
Authenticated attackers can include arbitrary local PHP files, leading to sensitive data exposure and potential remote code execution on the WordPress host.

Affected Products

mojoomla WPGYM (Gym Management) WordPress plugin
All versions from n/a through 65.0
WordPress sites running the vulnerable plugin

Discovery Timeline

2025-06-17 - CVE-2025-32549 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32549

Vulnerability Analysis

The WPGYM plugin accepts user-controlled input that is passed into a PHP include or require statement without proper validation or sanitization. This pattern, tracked as [CWE-98], allows attackers to influence which file the PHP interpreter loads at runtime. Although the issue is categorized as PHP Remote File Inclusion, the practical attack surface is restricted to local file inclusion based on PHP configuration defaults that disable allow_url_include.

An attacker with at least low-privilege authentication can supply path traversal sequences or absolute paths to load files outside the intended directory. Targets typically include wp-config.php, session files, server logs, and uploaded files containing PHP payloads. Including such files causes their contents to be parsed and executed as PHP code.

Root Cause

The root cause is missing input validation on a filename parameter consumed by an include, include_once, require, or require_once call. The plugin does not enforce an allowlist of permitted files, does not normalize paths, and does not reject directory traversal sequences such as ../. This violates secure coding guidance for dynamic file inclusion in PHP.

Attack Vector

Exploitation requires network access to the WordPress instance and authenticated access with low privileges, such as a subscriber or customer account. The attacker issues an HTTP request to a vulnerable WPGYM endpoint and supplies a crafted value for the file parameter. The plugin then includes the attacker-specified file, executing its contents in the WordPress PHP context. EPSS data places the exploitation probability at 0.449%. Refer to the Patchstack WPGym Local File Inclusion Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-32549

Indicators of Compromise

HTTP requests to WPGYM plugin endpoints containing ../ sequences or absolute file paths in query or POST parameters
Web server access logs showing requests referencing sensitive files such as wp-config.php, /etc/passwd, or PHP session files
Unexpected PHP errors referencing include() or require() failures in WordPress debug logs
New or modified PHP files in WordPress upload directories that correlate with LFI request patterns

Detection Strategies

Monitor WordPress request logs for path traversal patterns targeting plugin paths under /wp-content/plugins/gym-management/
Deploy web application firewall (WAF) rules that flag suspicious filename parameters delivered to plugin endpoints
Correlate authenticated low-privilege user sessions with requests containing file path parameters

Monitoring Recommendations

Enable WordPress access and error logging and forward logs to a centralized SIEM for analysis
Alert on reads of sensitive files such as wp-config.php by the web server process outside normal application flows
Track plugin file integrity to detect unauthorized writes to the gym-management plugin directory

How to Mitigate CVE-2025-32549

Immediate Actions Required

Identify all WordPress instances running the WPGYM (gym-management) plugin at version 65.0 or earlier
Disable the WPGYM plugin until a patched version is installed if active exploitation is suspected
Restrict low-privilege user registration on affected sites to reduce the pool of accounts able to authenticate
Audit user accounts and recent administrative activity for signs of post-exploitation persistence

Patch Information

At the time of publication, the Patchstack advisory lists all versions through 65.0 as vulnerable. Site operators should monitor the WPGYM vendor channel for an updated release and apply it as soon as it becomes available. Until then, treat the plugin as actively vulnerable on any exposed instance.

Workarounds

Block requests to WPGYM endpoints at the WAF when filename parameters contain traversal characters such as ../, null bytes, or absolute paths
Set the PHP open_basedir directive to restrict file access to the WordPress installation directory
Ensure allow_url_include and allow_url_fopen remain disabled in php.ini to limit attack escalation
Apply least privilege to the web server user so that sensitive system files cannot be read by the PHP process

bash

# Example php.ini hardening to limit LFI impact
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"