CVE-2025-32656: Testimonial Slider Pro LFI Vulnerability

CVE-2025-32656 Overview

CVE-2025-32656 is a PHP Local File Inclusion (LFI) vulnerability in the RadiusTheme Testimonial Slider And Showcase Pro plugin for WordPress. The flaw stems from improper control of filename parameters used in PHP include or require statements [CWE-98]. Attackers can leverage this weakness to include arbitrary local files through the plugin's request handlers. The vulnerability affects all versions of Testimonial Slider And Showcase Pro up to and including 2.3.15. Successful exploitation can lead to disclosure of sensitive server files, execution of attacker-controlled PHP code, and full compromise of the underlying WordPress site.

Critical Impact

Unauthenticated attackers can include and execute arbitrary local files on affected WordPress installations, leading to remote code execution and full site takeover.

Affected Products

• RadiusTheme Testimonial Slider And Showcase Pro (testimonial-slider-showcase-pro)
• Versions from n/a through <= 2.3.15
• WordPress installations running the vulnerable plugin

Discovery Timeline

• 2025-04-11 - CVE-2025-32656 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32656

Vulnerability Analysis

The vulnerability is classified as Improper Control of Filename for Include/Require Statement in PHP Program [CWE-98]. The plugin accepts user-controlled input and passes it into a PHP include, include_once, require, or require_once statement without adequate validation or sanitization. This allows attackers to redirect the include path to arbitrary files on the local filesystem.

Because PHP executes any included .php file in the context of the web server, an attacker who can place or influence a file on the server can achieve remote code execution. Even where direct file upload is not possible, attackers can use log poisoning, session files, or temporary upload paths to gain code execution. The EPSS score of 0.547% reflects current exploitation likelihood, but plugin-level LFI flaws in WordPress historically attract automated scanning shortly after disclosure.

Root Cause

The root cause is the plugin's failure to enforce an allowlist of permitted include targets and the absence of canonicalization for path inputs. User-supplied values reach a filesystem include function without restriction to a fixed directory, file extension whitelist, or numeric template identifier.

Attack Vector

The attack is network-based and does not require authentication or user interaction. An attacker sends a crafted HTTP request to a plugin endpoint that processes a filename or template parameter. The plugin then includes the attacker-specified path, executing any PHP content it contains. Path traversal sequences or absolute paths can be used to reach files outside the plugin directory, including WordPress configuration files and operating system resources accessible to the web server user.

No verified public proof-of-concept code is available. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-32656

Indicators of Compromise

• HTTP requests to plugin endpoints under /wp-content/plugins/testimonial-slider-showcase-pro/ containing path traversal sequences such as ../ or absolute paths like /etc/passwd.
• Access log entries showing query parameters referencing PHP files, wp-config.php, or log files like /var/log/apache2/access.log.
• Unexpected PHP files written to wp-content/uploads/ or temporary directories shortly before plugin requests.
• Web server processes spawning shells (sh, bash) or outbound connections originating from PHP-FPM workers.

Detection Strategies

• Inspect WordPress access logs for parameter values containing ../, null bytes (%00), or paths ending in .php passed to Testimonial Slider And Showcase Pro endpoints.
• Deploy WAF rules that block path traversal patterns and absolute filesystem paths in query and POST parameters targeting the plugin.
• Monitor for file integrity changes within the WordPress installation, particularly new or modified files under wp-content/.

Monitoring Recommendations

• Forward web server, PHP error, and WordPress audit logs to a centralized SIEM for correlation against plugin paths and known LFI signatures.
• Alert on PHP processes invoking system binaries such as curl, wget, nc, or shell interpreters from the web root.
• Track installed plugin versions across all WordPress hosts to identify instances still running testimonial-slider-showcase-pro at or below version 2.3.15.

How to Mitigate CVE-2025-32656

Immediate Actions Required

• Update Testimonial Slider And Showcase Pro to a version above 2.3.15 as soon as the vendor publishes a fixed release.
• If no patched version is available, deactivate and remove the plugin from all WordPress installations.
• Audit web server and PHP logs for evidence of exploitation attempts dating back to before plugin installation.
• Rotate WordPress secrets in wp-config.php, database credentials, and any API keys reachable from the web root if compromise is suspected.

Patch Information

Consult the Patchstack Vulnerability Report for the latest patch status and vendor advisory. Apply updates through the WordPress plugin manager and verify the installed version after deployment.

Workarounds

• Block requests to wp-content/plugins/testimonial-slider-showcase-pro/ at the WAF or reverse proxy until the plugin is patched or removed.
• Set PHP open_basedir to restrict the filesystem paths accessible to the web application, limiting the scope of any include operation.
• Disable PHP execution within wp-content/uploads/ using web server configuration to prevent code execution via uploaded files.
• Apply virtual patching rules from the WordPress security vendor to filter LFI payloads against the affected plugin endpoints.

# Example Nginx configuration to block access to the vulnerable plugin
location ~* /wp-content/plugins/testimonial-slider-showcase-pro/ {
    deny all;
    return 403;
}

# Disable PHP execution in uploads directory
location ~* /wp-content/uploads/.*\.php$ {
    deny all;
    return 403;
}