CVE-2025-32654: Motors Plugin LFI Vulnerability

CVE-2025-32654 Overview

CVE-2025-32654 is a PHP Local File Inclusion (LFI) vulnerability affecting the Stylemix Motors motors-car-dealership-classified-listings WordPress plugin. The flaw stems from improper control of filenames used in PHP include or require statements [CWE-98]. Attackers can manipulate file path parameters to include arbitrary local PHP files on the server. The vulnerability impacts all plugin versions up to and including 1.4.71. Successful exploitation can lead to arbitrary code execution, sensitive file disclosure, and full site compromise on affected WordPress installations.

Critical Impact

Unauthenticated attackers can include local PHP files, potentially achieving remote code execution and complete compromise of WordPress sites running the vulnerable Motors plugin.

Affected Products

• Stylemix Motors - Car Dealership & Classified Listings WordPress plugin
• Plugin versions from initial release through 1.4.71
• WordPress installations using the Motors plugin for vehicle listings

Discovery Timeline

• 2025-04-11 - CVE-2025-32654 published to the National Vulnerability Database
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32654

Vulnerability Analysis

The Motors plugin includes PHP files based on user-supplied input without proper sanitization or allowlisting. An attacker submits a crafted parameter that resolves to a local file path. The PHP include or require statement then loads and executes the referenced file within the WordPress process context.

Local File Inclusion vulnerabilities classified under [CWE-98] often enable broader exploitation chains. Attackers can include log files, session files, or uploaded media containing PHP payloads. When combined with file upload features or log poisoning techniques, LFI commonly escalates to remote code execution.

The attack requires network access to the target WordPress site and no authentication. Although exploitation complexity is rated high, public WordPress sites with the affected plugin are reachable by any internet attacker.

Root Cause

The root cause is unsanitized user input flowing into a dynamic file inclusion statement. The plugin fails to validate that requested filenames belong to an allowlist of safe templates. It also fails to neutralize path traversal sequences such as ../ that allow escaping the intended directory.

Attack Vector

The vulnerability is exploited remotely over HTTP or HTTPS against the WordPress site hosting the plugin. An attacker sends a request to a vulnerable endpoint with a manipulated parameter pointing to a local file. The PHP interpreter then includes that file, executing any PHP content it contains. Detailed technical analysis is published in the Patchstack Vulnerability Report.

Detection Methods for CVE-2025-32654

Indicators of Compromise

• HTTP requests to Motors plugin endpoints containing path traversal sequences such as ../, ..%2f, or encoded null bytes
• Unexpected PHP errors in web server logs referencing include(), require(), or failed to open stream
• Web shells or unfamiliar PHP files appearing under wp-content/uploads/ or plugin directories
• Outbound connections from the web server process to attacker-controlled infrastructure following suspicious requests

Detection Strategies

• Inspect access logs for requests targeting the motors-car-dealership-classified-listings plugin paths with suspicious file parameters
• Deploy web application firewall rules that flag path traversal patterns and absolute file paths in query strings
• Monitor file integrity on the WordPress installation to detect new or modified PHP files
• Correlate WordPress request logs with PHP-FPM and Apache or Nginx error logs to identify inclusion failures

Monitoring Recommendations

• Forward WordPress, PHP, and web server logs to a centralized logging platform for retention and analysis
• Alert on read access to sensitive files such as wp-config.php, /etc/passwd, or /proc/self/environ from the web server user
• Track plugin version inventory across managed WordPress sites and flag installations below the patched release
• Review newly created administrator accounts and scheduled tasks on affected WordPress sites

How to Mitigate CVE-2025-32654

Immediate Actions Required

• Update the Stylemix Motors plugin to a version newer than 1.4.71 as soon as the vendor publishes a fixed release
• If no patched version is available, disable and remove the Motors plugin until a fix is released
• Audit affected WordPress sites for web shells, unauthorized administrator accounts, and modified core files
• Rotate WordPress secrets, database credentials, and API keys stored in wp-config.php on potentially compromised sites

Patch Information

Review the Patchstack Vulnerability Report for the latest vendor patch status and remediation guidance. Apply the fixed release through the WordPress plugin updater once it becomes available, and verify the installed version after upgrade.

Workarounds

• Restrict access to Motors plugin endpoints using web application firewall rules that block path traversal patterns
• Configure PHP open_basedir to limit file inclusion to specific directories within the WordPress installation
• Set allow_url_include=Off and allow_url_fopen=Off in php.ini to reduce inclusion attack surface
• Apply least-privilege filesystem permissions so the web server user cannot read sensitive system files

# Configuration example
# php.ini hardening to limit file inclusion exposure
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Nginx rule to block obvious traversal attempts on the Motors plugin path
location ~* /wp-content/plugins/motors-car-dealership-classified-listings/ {
    if ($args ~* "\.\./|\.\.%2f|/etc/passwd|wp-config\.php") {
        return 403;
    }
}