CVE-2025-32654: Motors Plugin LFI Vulnerability

CVE-2025-32654 Overview

CVE-2025-32654 is a PHP Local File Inclusion (LFI) vulnerability affecting the Stylemix Motors motors-car-dealership-classified-listings WordPress plugin. The flaw resides in improper control of a filename used in a PHP include or require statement [CWE-98]. Attackers can supply attacker-controlled input to a file inclusion routine and force the plugin to load arbitrary local PHP files. Successful exploitation can lead to sensitive information disclosure, configuration leakage, and arbitrary code execution when combined with file upload primitives. The issue affects all versions of the Motors plugin up to and including 1.4.71.

Critical Impact
Remote, unauthenticated attackers can include local PHP files on vulnerable WordPress sites, potentially leading to remote code execution and full site compromise.

Affected Products

Stylemix Motors motors-car-dealership-classified-listings plugin for WordPress
All versions from n/a through 1.4.71
WordPress sites running the Motors car dealership theme/plugin ecosystem

Discovery Timeline

2025-04-11 - CVE-2025-32654 published to the National Vulnerability Database
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32654

Vulnerability Analysis

The vulnerability is classified as Improper Control of Filename for Include/Require Statement in PHP Program [CWE-98], commonly called PHP Remote File Inclusion. In this case, the issue manifests as a Local File Inclusion (LFI) because attacker-supplied input flows into a PHP include or require statement without proper validation or path normalization.

The attack vector is network-based and requires no authentication or user interaction. Exploitation requires specific conditions or timing, which raises attack complexity. Successful exploitation impacts confidentiality, integrity, and availability of the affected WordPress site.

Root Cause

The root cause is the plugin passing user-controlled values directly into a PHP file inclusion function without enforcing an allow-list of valid template or module names. The plugin fails to sanitize directory traversal sequences such as ../ and does not constrain inclusion to a fixed base directory. This allows attackers to reference arbitrary .php files on the server filesystem.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to a vulnerable plugin endpoint, supplying a parameter that controls the path of an included file. By using path traversal sequences or absolute paths, the attacker forces the plugin to include and execute PHP files outside the intended directory. When combined with log poisoning, session files, or attacker-controlled uploads, the LFI can escalate to remote code execution.

No verified public proof-of-concept code is currently available. Refer to the Patchstack WordPress Vulnerability advisory for additional technical context.

Detection Methods for CVE-2025-32654

Indicators of Compromise

HTTP requests to Motors plugin endpoints containing path traversal sequences such as ../, ..%2f, or encoded variants in query parameters
Web server access logs showing references to sensitive files such as wp-config.php, /etc/passwd, or /proc/self/environ
Unexpected PHP errors or warnings referencing include() or require() failures with attacker-controlled paths
New or modified PHP files under the WordPress uploads directory following suspicious plugin requests

Detection Strategies

Inventory all WordPress installations and identify sites running the Motors plugin at version 1.4.71 or earlier
Deploy web application firewall (WAF) rules to flag path traversal patterns targeting plugin parameters
Review PHP error logs for inclusion failures referencing unusual or absolute file paths
Hunt for anomalous outbound connections originating from the PHP-FPM or web server process

Monitoring Recommendations

Forward web server, PHP, and WordPress audit logs to a centralized SIEM for correlation
Alert on HTTP 200 responses to plugin URLs containing traversal sequences or .php references in query strings
Monitor for file integrity changes in WordPress core, plugin, and theme directories
Track new administrator account creation and changes to wp-config.php following suspicious requests

How to Mitigate CVE-2025-32654

Immediate Actions Required

Update the Stylemix Motors plugin to a version newer than 1.4.71 as soon as the vendor publishes a patched release
Audit web server and PHP logs for indicators of prior exploitation against the plugin
Rotate WordPress secrets, database credentials, and administrator passwords if exploitation is suspected
Restrict access to the WordPress site behind a WAF until patching is complete

Patch Information

Review the Patchstack advisory for the latest patched version of the motors-car-dealership-classified-listings plugin. Apply the vendor-supplied update through the WordPress plugin manager or by replacing the plugin files manually. Verify the installed version after update to confirm remediation.

Workarounds

Disable and remove the Motors plugin until a patched version is installed
Deploy WAF rules that block requests containing path traversal sequences targeting plugin endpoints
Set the PHP open_basedir directive to restrict file inclusion to the WordPress installation directory
Enforce least privilege on the web server user to limit readable files outside the document root

bash

# Example php.ini hardening to limit file inclusion scope
open_basedir = "/var/www/html/:/tmp/"
allow_url_include = Off
allow_url_fopen = Off