CVE-2025-32589: Flexi Guest Submit LFI Vulnerability

CVE-2025-32589 Overview

CVE-2025-32589 is a PHP Local File Inclusion (LFI) vulnerability in the odude Flexi – Guest Submit WordPress plugin. The flaw stems from improper control of filename parameters used in PHP include or require statements [CWE-98]. The vulnerability affects all versions of Flexi – Guest Submit up to and including 4.28. An unauthenticated remote attacker can exploit this issue over the network to include arbitrary local PHP files, leading to code execution, sensitive file disclosure, and full site compromise.

Critical Impact
Successful exploitation allows unauthenticated attackers to read arbitrary files and execute PHP code on the WordPress host, compromising confidentiality, integrity, and availability.

Affected Products

odude Flexi – Guest Submit plugin for WordPress
All versions from initial release through 4.28
WordPress sites with the plugin installed and active

Discovery Timeline

2025-04-11 - CVE-2025-32589 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32589

Vulnerability Analysis

The Flexi – Guest Submit plugin accepts attacker-controlled input that is passed to a PHP file inclusion construct without adequate sanitization. This category of flaw is classified under CWE-98, Improper Control of Filename for Include/Require Statement in PHP Program. While the CVE title references PHP Remote File Inclusion, the confirmed impact is Local File Inclusion on the affected WordPress host.

An attacker can manipulate the filename parameter to traverse the filesystem and include arbitrary .php files available to the web server process. If combined with file upload primitives, log poisoning, or PHP wrappers such as php://filter and data://, an LFI condition can escalate into remote code execution within the WordPress runtime.

The issue requires no authentication and no user interaction. The attack complexity is elevated because successful exploitation depends on environmental factors such as PHP configuration directives (allow_url_include, open_basedir) and the presence of includable target files.

Root Cause

The root cause is the use of unvalidated, attacker-controllable input as the argument to a PHP include or require statement. The plugin fails to enforce an allowlist of permitted files and does not normalize path traversal sequences before invoking the inclusion. This breaks the trust boundary between HTTP request data and server-side code execution.

Attack Vector

The attack vector is network-based. An unauthenticated attacker sends a crafted HTTP request to a vulnerable plugin endpoint, supplying a filename parameter that resolves to a local PHP file. The web server executes the included file with the privileges of the PHP process. Refer to the Patchstack WordPress Vulnerability Report for additional technical details.

Detection Methods for CVE-2025-32589

Indicators of Compromise

HTTP requests to plugin endpoints containing path traversal sequences such as ../, ..%2f, or encoded null bytes
Query parameters referencing sensitive files such as wp-config.php, /etc/passwd, or PHP session files
Use of PHP stream wrappers including php://filter, php://input, or data:// in request parameters
Unexpected PHP execution originating from uploaded files, temporary directories, or log paths

Detection Strategies

Inspect web server access logs for requests targeting /wp-content/plugins/flexi/ with suspicious filename parameters
Deploy WordPress-aware web application firewall rules that block LFI patterns and PHP wrapper schemes
Monitor PHP-FPM and Apache error logs for include() or require() failures referencing unexpected paths
Correlate plugin requests with subsequent outbound connections that could indicate post-exploitation activity

Monitoring Recommendations

Enable file integrity monitoring on the WordPress installation directory and plugin folders
Alert on new or modified PHP files within wp-content/uploads/ and other writable paths
Track process creation events from the web server user that spawn shells or scripting interpreters
Aggregate WordPress, PHP, and web server telemetry into a centralized analytics platform for correlation

How to Mitigate CVE-2025-32589

Immediate Actions Required

Deactivate and remove the Flexi – Guest Submit plugin if a patched version is not available
Audit the WordPress site for unauthorized administrator accounts, modified PHP files, and webshells
Rotate WordPress secret keys, database credentials, and any API tokens stored in wp-config.php
Restrict access to plugin endpoints at the web application firewall or reverse proxy layer

Patch Information

As of the last NVD modification date, no fixed version above 4.28 is recorded in the available references. Administrators should consult the Patchstack advisory and the plugin vendor for updated release information before reactivating the plugin.

Workarounds

Disable the plugin until a verified patch is published by the vendor
Set allow_url_include = Off and configure open_basedir to restrict PHP file access to required directories
Apply WAF rules to block requests containing path traversal sequences and PHP stream wrapper schemes
Run the PHP process as a least-privileged user with no write access to plugin or core WordPress directories

bash

# Configuration example: harden php.ini and disable the vulnerable plugin
# /etc/php/php.ini
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Disable the plugin via WP-CLI until a patch is available
wp plugin deactivate flexi
wp plugin delete flexi