CVE-2025-32663: FAT Coming Soon Path Traversal Flaw

CVE-2025-32663 Overview

CVE-2025-32663 is a Local File Inclusion (LFI) vulnerability affecting the FAT Cooming Soon WordPress plugin (fat-coming-soon) developed by roninwp. This vulnerability arises from improper control of filename parameters in PHP include/require statements, allowing attackers to include arbitrary local files from the server.

The vulnerability is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). While initially categorized as a PHP Remote File Inclusion issue, the actual exploitation vector enables PHP Local File Inclusion attacks against affected WordPress installations.

Critical Impact

Attackers can exploit this vulnerability to read sensitive files, potentially leading to information disclosure, configuration file exposure, and in certain scenarios, remote code execution through log poisoning or other LFI-to-RCE techniques.

Affected Products

• FAT Cooming Soon WordPress Plugin version 1.1 and earlier
• WordPress installations running vulnerable versions of fat-coming-soon plugin
• Web servers hosting WordPress sites with this plugin enabled

Discovery Timeline

• 2025-04-11 - CVE-2025-32663 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32663

Vulnerability Analysis

The FAT Cooming Soon plugin contains a Local File Inclusion vulnerability that stems from insufficient validation of user-controlled input when constructing file paths for PHP's include or require functions. This allows an attacker to manipulate the filename parameter to reference arbitrary files on the server's filesystem.

Local File Inclusion vulnerabilities in WordPress plugins are particularly dangerous because WordPress's directory structure is predictable. Attackers familiar with WordPress can target known configuration files such as wp-config.php, which contains database credentials, authentication keys, and other sensitive configuration data.

The network-accessible nature of this vulnerability means unauthenticated remote attackers can potentially exploit it without requiring any prior authentication to the WordPress site. While the attack complexity is considered high, successful exploitation could result in complete compromise of confidentiality, integrity, and availability of the affected system.

Root Cause

The root cause of this vulnerability is the improper sanitization of user-supplied input that is subsequently used in PHP file inclusion operations. The plugin fails to adequately validate or restrict the filenames passed to include(), include_once(), require(), or require_once() functions.

Common patterns that lead to such vulnerabilities include:

• Direct use of $_GET, $_POST, or $_REQUEST variables in file paths
• Insufficient path traversal filtering (not properly blocking ../ sequences)
• Missing whitelist validation of allowed files
• Reliance on blacklist filtering which can be bypassed

Attack Vector

This vulnerability is exploitable over the network, requiring no authentication. The attacker constructs malicious HTTP requests containing path traversal sequences or specially crafted filenames to include arbitrary local files.

A typical attack scenario involves the attacker sending a request with manipulated parameters to the vulnerable endpoint. The attacker may use directory traversal techniques (e.g., ../../../etc/passwd on Linux systems) to escape the intended directory and access sensitive system or application files.

Successful exploitation can lead to:

• Disclosure of sensitive configuration files (database credentials, API keys)
• Reading of application source code
• Potential remote code execution through log poisoning if the attacker can inject PHP code into log files and then include those logs
• Server-side request forgery in combination with PHP wrappers

For detailed technical information about this vulnerability, refer to the Patchstack vulnerability database entry.

Detection Methods for CVE-2025-32663

Indicators of Compromise

• Unusual HTTP requests to the FAT Cooming Soon plugin endpoints containing path traversal sequences (../, ..%2f, ..%5c)
• Web server access logs showing requests with PHP wrapper protocols (php://filter, php://input, data://)
• Unexpected file access patterns in WordPress plugin directories
• Evidence of wp-config.php or system file content in response bodies

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in requests targeting WordPress plugins
• Monitor web server logs for suspicious requests containing directory traversal sequences or PHP stream wrappers
• Deploy file integrity monitoring on critical WordPress configuration files
• Utilize intrusion detection systems (IDS) with signatures for LFI attack patterns

Monitoring Recommendations

• Enable detailed access logging for all WordPress plugin endpoints
• Configure alerts for requests containing common LFI patterns such as ../, ..\\, or encoded variants
• Monitor for unusual file read operations on the server, particularly targeting configuration files
• Implement anomaly detection for requests with unusually long path parameters

How to Mitigate CVE-2025-32663

Immediate Actions Required

• Deactivate and remove the FAT Cooming Soon plugin (fat-coming-soon) immediately if running version 1.1 or earlier
• Audit WordPress installations for the presence of this vulnerable plugin
• Review server logs for evidence of exploitation attempts
• Consider rotating database credentials and authentication keys if compromise is suspected

Patch Information

At the time of publication, the affected versions include FAT Cooming Soon version 1.1 and all earlier versions. Users should check for updates from the plugin developer (roninwp) and apply any available security patches. If no patch is available, the plugin should be replaced with a secure alternative.

For the latest vulnerability and patch information, refer to the Patchstack advisory.

Workarounds

• Remove or disable the FAT Cooming Soon plugin until a patched version is available
• Implement WAF rules to block requests containing path traversal patterns targeting the plugin
• Restrict access to the WordPress admin area and plugin directories via IP allowlisting
• Use a security plugin to add an additional layer of input validation for plugin requests

# WordPress CLI command to deactivate the vulnerable plugin
wp plugin deactivate fat-coming-soon --path=/var/www/html/wordpress

# Verify plugin status
wp plugin list --path=/var/www/html/wordpress | grep fat-coming-soon

# Optional: Remove the plugin entirely
wp plugin delete fat-coming-soon --path=/var/www/html/wordpress