CVE-2025-32629: WP-BusinessDirectory Path Traversal Flaw

CVE-2025-32629 Overview

CVE-2025-32629 is a path traversal vulnerability in the CMSJunkie WP-BusinessDirectory WordPress plugin. The flaw affects all versions from initial release through 3.1.2 and is tracked under CWE-22. An unauthenticated attacker can manipulate file path parameters to reach files outside the plugin's intended directory, enabling arbitrary file deletion on the WordPress host.

The vulnerability is reachable over the network without authentication or user interaction. Successful exploitation impacts availability by allowing deletion of files critical to the WordPress installation, including wp-config.php, which can force the site into a setup state.

Critical Impact
Unauthenticated attackers can delete arbitrary files on the WordPress server, leading to site compromise or full denial of service.

Affected Products

CMSJunkie WP-BusinessDirectory WordPress plugin versions up to and including 3.1.2
WordPress sites running the wp-businessdirectory plugin with default configuration
All hosting environments where the vulnerable plugin is active

Discovery Timeline

2025-04-11 - CVE-2025-32629 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32629

Vulnerability Analysis

The WP-BusinessDirectory plugin fails to properly validate user-supplied file path input before performing file system operations. The plugin accepts a filename or path parameter and passes it to a deletion routine without normalizing or restricting it to an allowed base directory.

An attacker submits crafted input containing directory traversal sequences such as ../ to escape the plugin's working directory. The deletion routine resolves the traversal sequences against the file system and removes the targeted file. Because the affected endpoint does not require authentication, exploitation requires only network reachability to the WordPress site.

The scope is marked as changed in the CVSS vector because file deletion affects resources beyond the vulnerable plugin's security boundary.

Root Cause

The plugin lacks input sanitization on a parameter used to construct a file path. There is no canonicalization step to detect .. segments and no allow-list restricting deletions to files inside the plugin's upload directory. The deletion handler is also missing authentication and capability checks.

Attack Vector

The attack is performed remotely by sending an HTTP request to the vulnerable plugin endpoint with a path parameter containing traversal sequences. The vulnerability mechanism is described in the Patchstack advisory. No verified public proof-of-concept code is available at the time of writing.

Detection Methods for CVE-2025-32629

Indicators of Compromise

HTTP requests to wp-admin/admin-ajax.php or plugin-specific endpoints containing ../ or URL-encoded %2e%2e%2f sequences in parameter values
Unexpected deletion of files in the WordPress root, including wp-config.php, .htaccess, or core PHP files
WordPress site entering installation or setup mode without administrator action
Web server error logs reporting missing files referenced by index.php or theme templates

Detection Strategies

Inspect access logs for requests targeting wp-businessdirectory endpoints with suspicious path parameters
Deploy file integrity monitoring on the WordPress installation directory to alert on deletions of core or configuration files
Configure web application firewall rules to flag directory traversal patterns in query strings and POST bodies

Monitoring Recommendations

Forward WordPress and web server logs to a centralized log platform for correlation against traversal patterns
Alert on any modification or deletion event affecting wp-config.php, .htaccess, or files under wp-includes/
Track outbound requests from the WordPress host that may indicate post-exploitation activity following file deletion

How to Mitigate CVE-2025-32629

Immediate Actions Required

Deactivate and remove the WP-BusinessDirectory plugin until a patched version is installed
Restrict access to the WordPress admin and AJAX endpoints using IP allow-listing where feasible
Restore deleted files from a known-good backup if exploitation is suspected
Audit user accounts and installed plugins for unauthorized changes following any confirmed exploitation

Patch Information

At the time of NVD publication, the vendor advisory linked through Patchstack lists all versions through 3.1.2 as affected. Administrators should upgrade to a version released after 3.1.2 once available from CMSJunkie and verify the fix in plugin release notes.

Workarounds

Block requests containing ../, ..\, or URL-encoded traversal sequences at the web application firewall layer
Run the PHP process under a least-privilege account that cannot delete files outside the WordPress uploads directory
Restrict file system permissions on wp-config.php and other critical files to prevent deletion by the web server user

bash

# Example WAF rule fragment to block path traversal on plugin endpoints
SecRule REQUEST_URI "@contains wp-businessdirectory" \
  "chain,id:1003229,phase:2,deny,status:403,msg:'WP-BusinessDirectory path traversal attempt'"
SecRule ARGS "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e/)" "t:lowercase,t:urlDecodeUni"