CVE-2025-32589: Flexi Guest Submit LFI Vulnerability

CVE-2025-32589 Overview

CVE-2025-32589 is a Local File Inclusion (LFI) vulnerability in the odude Flexi – Guest Submit WordPress plugin. The flaw stems from improper control of filenames passed to PHP include or require statements [CWE-98]. Attackers can exploit this issue over the network without authentication to read arbitrary local files or execute PHP code present on the server. The vulnerability affects all plugin versions up to and including 4.28. Successful exploitation can expose sensitive configuration data, credentials, and lead to full site compromise when chained with file upload or log poisoning techniques.

Critical Impact

Unauthenticated attackers can include arbitrary local PHP files, potentially achieving remote code execution and full WordPress site takeover.

Affected Products

• odude Flexi – Guest Submit WordPress plugin
• All versions from n/a through 4.28
• WordPress sites running the vulnerable plugin

Discovery Timeline

• 2025-04-11 - CVE-2025-32589 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32589

Vulnerability Analysis

The Flexi – Guest Submit plugin fails to properly validate user-controlled input that flows into a PHP include or require statement. This pattern, classified as [CWE-98], allows attackers to manipulate the filename parameter and force the application to include unintended files from the local filesystem. Because PHP executes any included file as code, an attacker who can place or reference a .php file on the server can achieve code execution in the WordPress process context.

The vulnerability operates over the network without requiring authentication or user interaction. The high attack complexity reflects conditions an attacker must satisfy, such as specific file paths or server configurations, but does not require privileged access.

Root Cause

The root cause is missing or insufficient sanitization of a filename or path parameter before it reaches a dynamic include statement. The plugin trusts user-supplied input to construct file paths, violating secure coding practices that require allow-listing of permitted files.

Attack Vector

An attacker sends a crafted HTTP request to a vulnerable plugin endpoint, supplying a manipulated path parameter. The server resolves the path and includes the targeted file. Attackers can read configuration files such as wp-config.php to extract database credentials, or include attacker-controlled files such as uploaded images, session files, or log entries containing injected PHP code. Refer to the Patchstack WordPress Vulnerability Report for advisory details.

Detection Methods for CVE-2025-32589

Indicators of Compromise

• HTTP requests to Flexi plugin endpoints containing path traversal sequences such as ../ or encoded variants like %2e%2e%2f.
• Requests referencing sensitive files including wp-config.php, /etc/passwd, or PHP wrappers like php://filter.
• Unexpected PHP processes spawned from the WordPress directory or anomalous outbound connections from the web server.
• Web server logs showing inclusion of files outside the plugin directory tree.

Detection Strategies

• Inspect access logs for query parameters containing file paths, traversal sequences, or PHP stream wrappers targeting Flexi plugin URLs.
• Deploy a Web Application Firewall (WAF) rule set that flags LFI patterns against /wp-content/plugins/flexi/ paths.
• Correlate web request anomalies with file system access events on critical WordPress files.

Monitoring Recommendations

• Enable verbose logging on the WordPress web server and forward logs to a centralized SIEM for analysis.
• Monitor read access to wp-config.php and other sensitive files outside expected application flows.
• Alert on PHP error log entries referencing failed include or require operations with unusual paths.

How to Mitigate CVE-2025-32589

Immediate Actions Required

• Disable or uninstall the Flexi – Guest Submit plugin until an official patched release is confirmed.
• Audit wp-config.php and rotate database credentials, secret keys, and any API tokens that may have been exposed.
• Review WordPress user accounts and uploaded files for signs of compromise or webshell artifacts.

Patch Information

At the time of publication, the vulnerability affects Flexi – Guest Submit versions up to and including 4.28. Site administrators should consult the Patchstack advisory and the plugin vendor for the latest fixed version, then update immediately.

Workarounds

• Block requests to vulnerable Flexi plugin endpoints at the WAF or reverse proxy until a patch is applied.
• Configure PHP open_basedir to restrict file inclusion to the WordPress installation directory.
• Set allow_url_include = Off and allow_url_fopen = Off in php.ini to limit remote inclusion vectors.
• Apply least-privilege file permissions so the web server cannot read sensitive files outside the web root.

# Configuration example: php.ini hardening
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"