CVE-2025-32668: Real Estate Manager LFI Vulnerability

CVE-2025-32668 Overview

CVE-2025-32668 is a Local File Inclusion (LFI) vulnerability in the Rameez Iqbal Real Estate Manager WordPress plugin. The flaw stems from improper control of filenames used in PHP include or require statements [CWE-98]. Attackers can manipulate file path parameters to load arbitrary PHP files from the server, leading to source code disclosure, sensitive configuration exposure, or remote code execution when combined with file upload primitives. The issue affects all versions of Real Estate Manager from n/a through 7.3. Patchstack tracks this vulnerability in its WordPress plugin database.

Critical Impact

Unauthenticated network-based exploitation can lead to arbitrary local file inclusion, exposing sensitive files such as wp-config.php and potentially enabling code execution.

Affected Products

• Rameez Iqbal Real Estate Manager plugin for WordPress
• All versions from initial release through 7.3
• WordPress installations with the real-estate-manager plugin active

Discovery Timeline

• 2025-04-10 - CVE-2025-32668 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-32668

Vulnerability Analysis

The Real Estate Manager plugin processes user-supplied input as part of a PHP include or require statement without sufficient validation. Attackers supply crafted path values that traverse the filesystem or reference local PHP files outside the intended scope. Successful exploitation grants the attacker read access to arbitrary files readable by the web server user. When attackers can stage controlled content on the server (for example, via log files, session files, or media uploads), the LFI condition can escalate to remote code execution under the PHP runtime.

The EPSS score for this vulnerability sits at 0.547% (68th percentile), indicating moderate predicted exploitation likelihood relative to other CVEs.

Root Cause

The root cause is a failure to sanitize and allowlist filenames passed to dynamic include/require calls. The plugin treats request-controlled values as trusted paths. This is a classic [CWE-98] pattern where dynamic file inclusion accepts attacker-controlled input without canonicalization, extension enforcement, or restriction to an approved directory.

Attack Vector

Exploitation occurs over the network against a vulnerable WordPress site exposing the plugin's endpoints. The attacker issues HTTP requests containing manipulated parameter values that resolve to local files. No authentication is required, but attack complexity is rated high, suggesting specific preconditions or input shaping are needed for reliable exploitation. Refer to the Patchstack Vulnerability Report for technical specifics.

Detection Methods for CVE-2025-32668

Indicators of Compromise

• HTTP requests to Real Estate Manager plugin endpoints containing path traversal sequences such as ../, ..%2f, or absolute paths like /etc/passwd.
• Web server access logs showing parameter values referencing sensitive files like wp-config.php, .htaccess, or PHP session files.
• PHP error logs reporting include/require failures with attacker-controlled paths.
• Unexpected outbound connections from the PHP worker process following suspicious plugin requests.

Detection Strategies

• Deploy Web Application Firewall (WAF) rules that block path traversal patterns targeting the /wp-content/plugins/real-estate-manager/ path.
• Inspect query and POST parameters for filesystem indicators such as php://, file://, or ..%2f sequences.
• Correlate plugin request anomalies with subsequent file read operations on sensitive paths.

Monitoring Recommendations

• Monitor WordPress audit logs for plugin activity originating from unauthenticated sessions.
• Alert on PHP include/require warnings referencing user-controlled paths.
• Track file integrity of wp-config.php and plugin directories for unauthorized changes.

How to Mitigate CVE-2025-32668

Immediate Actions Required

• Disable the Real Estate Manager plugin until a patched release is verified and installed.
• Restrict access to the WordPress admin and plugin endpoints using IP allowlisting where feasible.
• Audit the web root for unauthorized PHP files, webshells, or modified plugin files.
• Rotate WordPress secrets, database credentials, and API keys if wp-config.php exposure is suspected.

Patch Information

At the time of publication, the vulnerability affects Real Estate Manager versions up to and including 7.3. Administrators should consult the Patchstack Vulnerability Report for the latest fixed version availability and update the plugin through the WordPress dashboard once a patched release is published.

Workarounds

• Apply virtual patching via a WAF to block requests containing path traversal payloads targeting the plugin.
• Set PHP open_basedir to constrain file access to approved directories only.
• Disable the allow_url_include directive in php.ini to prevent remote file inclusion escalation.
• Remove the plugin entirely if it is not business-critical.

# Configuration example - php.ini hardening
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"