CVE-2025-32585 Overview
CVE-2025-32585 is a path traversal vulnerability in the Trusty Plugins Shop Products Filter (trusty-woo-products-filter) WordPress plugin. The flaw enables PHP Local File Inclusion (LFI) through manipulated path sequences such as .../...//. Attackers with low-privileged authenticated access can include arbitrary local files on the underlying server. The issue affects all versions of Shop Products Filter up to and including 1.2. The vulnerability is classified under CWE-35: Path Traversal: '.../...//'.
Critical Impact
Successful exploitation enables local file inclusion, exposing sensitive configuration files, credentials, and potentially leading to remote code execution through PHP file inclusion primitives.
Affected Products
- Trusty Plugins Shop Products Filter (trusty-woo-products-filter)
- All versions from n/a through 1.2
- WordPress installations using the affected plugin
Discovery Timeline
- 2025-04-11 - CVE-2025-32585 published to NVD
- 2026-04-23 - Last updated in NVD database
Technical Details for CVE-2025-32585
Vulnerability Analysis
The vulnerability stems from improper sanitization of user-supplied input used in file path construction. The plugin processes path segments containing obfuscated traversal sequences such as .../...//, which standard filters targeting ../ may fail to normalize. When the input reaches a PHP file inclusion sink, attackers can reference files outside the intended directory.
The attack surface is reachable over the network, but exploitation requires a low-privileged authenticated session. The vulnerability impacts confidentiality, integrity, and availability because included PHP files execute within the WordPress process context.
Root Cause
The root cause is insufficient validation of path components passed to PHP file inclusion functions such as include, include_once, require, or require_once. The .../...// sequence collapses to ../ after partial sanitization routines strip a single ../ substring. This bypass technique defeats naive blacklist filtering and allows directory escape.
Attack Vector
An authenticated attacker submits a crafted request to a plugin endpoint that accepts a filename or template parameter. The payload contains traversal sequences designed to evade input filters. The PHP interpreter resolves the path and includes the target file, executing any PHP code it contains. Attackers commonly target log files, session storage, or uploaded media to achieve code execution after writing controlled content. Refer to the Patchstack Vulnerability Report for additional technical context.
Detection Methods for CVE-2025-32585
Indicators of Compromise
- HTTP requests to trusty-woo-products-filter endpoints containing .../...//, ..%2f, or encoded traversal sequences in parameters.
- PHP error log entries referencing failed include or require calls with paths outside the plugin directory.
- Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or /proc/self/environ from the web server process.
Detection Strategies
- Inspect WordPress access logs for requests targeting plugin parameters with directory traversal patterns.
- Deploy web application firewall (WAF) rules that detect path traversal obfuscation, including .../...// and URL-encoded variants.
- Monitor PHP execution telemetry for file inclusion operations originating from plugin code paths.
Monitoring Recommendations
- Enable verbose logging on the WordPress reverse proxy or WAF and forward events to a centralized SIEM.
- Alert on outbound process activity spawned by the PHP-FPM or web server user that deviates from baseline.
- Track plugin version inventory across WordPress sites to identify vulnerable instances of trusty-woo-products-filter 1.2 and earlier.
How to Mitigate CVE-2025-32585
Immediate Actions Required
- Disable or remove the Trusty Plugins Shop Products Filter plugin until a fixed version is confirmed.
- Audit WordPress user accounts and revoke unnecessary low-privileged access that could be used to reach the vulnerable endpoints.
- Review server logs for prior exploitation attempts referencing the affected plugin paths.
Patch Information
As of the last NVD update, no fixed version has been published for the Shop Products Filter plugin. The vulnerability affects all releases through 1.2. Monitor the Patchstack advisory for vendor updates and patch availability.
Workarounds
- Uninstall the affected plugin and replace it with a maintained alternative for product filtering functionality.
- Configure a WAF rule to block requests containing .../...//, ..%2f, ..%5c, or other traversal obfuscations targeting plugin URIs.
- Restrict PHP open_basedir and disable_functions directives to limit file inclusion scope and reduce post-exploitation impact.
# Example open_basedir restriction in php.ini
open_basedir = "/var/www/html/:/tmp/"
disable_functions = "exec,passthru,shell_exec,system,proc_open,popen"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
