CVE-2025-52728: Responsive Posts Carousel Pro LFI Flaw

CVE-2025-52728 Overview

CVE-2025-52728 is a PHP Local File Inclusion (LFI) vulnerability in the WebCodingPlace Responsive Posts Carousel Pro WordPress plugin. The flaw stems from improper control of filenames used in PHP include or require statements, classified under [CWE-98]. All plugin versions up to and including 15.0 are affected.

An authenticated attacker can manipulate file path parameters to force the plugin to include arbitrary local PHP files. Successful exploitation can lead to sensitive information disclosure, execution of attacker-controlled PHP code, and full compromise of the WordPress site.

Critical Impact
Attackers with low-privileged WordPress accounts can include local files and execute arbitrary PHP, leading to confidentiality, integrity, and availability loss on affected sites.

Affected Products

WebCodingPlace Responsive Posts Carousel Pro (responsive-posts-carousel-pro)
All versions through 15.0
WordPress installations running the vulnerable plugin

Discovery Timeline

2025-08-14 - CVE-2025-52728 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-52728

Vulnerability Analysis

The vulnerability is a PHP File Inclusion flaw mapped to [CWE-98]. The plugin accepts user-controlled input and passes it to a PHP include or require statement without sufficient sanitization or allowlisting. An attacker with at least low privileges on the WordPress site can supply a crafted path value that resolves to an arbitrary file on the server.

When the included file contains PHP code, that code executes in the context of the web server process. Even when an attacker can only include non-PHP files, exposure of configuration files such as wp-config.php can disclose database credentials and secret keys.

The CVSS vector indicates a network-reachable attack that requires authentication but no user interaction. Impact spans confidentiality, integrity, and availability, reflecting the potential for full site compromise once arbitrary PHP execution is achieved.

Root Cause

The root cause is improper validation of a filename or path parameter consumed by an include, include_once, require, or require_once statement in the plugin code. The plugin neither restricts the input to a fixed allowlist of templates nor sanitizes traversal sequences such as ../.

Attack Vector

An authenticated attacker sends a crafted HTTP request to a vulnerable plugin endpoint, supplying a path value that points to a local file. The PHP interpreter loads and executes the targeted file. Attackers commonly chain LFI with log poisoning, session file inclusion, or upload of attacker-controlled content to achieve remote code execution. Refer to the Patchstack WordPress Vulnerability Report for the advisory details.

Detection Methods for CVE-2025-52728

Indicators of Compromise

HTTP requests to Responsive Posts Carousel Pro endpoints containing path traversal sequences such as ../../ or absolute paths like /etc/passwd.
Web server access logs showing parameter values referencing wp-config.php, /proc/self/environ, or PHP session files under /tmp/ or /var/lib/php/sessions/.
Unexpected PHP errors in logs referencing include() or require() failures with attacker-controlled paths.
New or modified PHP files in plugin, theme, or uploads directories following suspicious requests.

Detection Strategies

Inspect WordPress request logs for parameters delivered to responsive-posts-carousel-pro handlers containing filesystem characters such as /, \, or %00.
Deploy a Web Application Firewall (WAF) rule that blocks traversal patterns and known LFI payloads targeting WordPress plugin endpoints.
Hunt for execution of php processes spawning shells (sh, bash) from the web server user account.

Monitoring Recommendations

Enable WordPress audit logging to record authenticated user actions and parameter values for plugin requests.
Monitor file integrity in wp-content/plugins/, wp-content/themes/, and wp-content/uploads/ for unauthorized PHP file creation.
Alert on outbound connections from the web server to unknown hosts that may indicate post-exploitation command and control.

How to Mitigate CVE-2025-52728

Immediate Actions Required

Identify all WordPress sites running Responsive Posts Carousel Pro and confirm the installed version.
Deactivate the plugin on sites running version 15.0 or earlier until a fixed release is available and applied.
Restrict access to the WordPress admin interface and rotate credentials for accounts that could reach the vulnerable endpoint.
Review web server and WordPress logs for prior exploitation attempts dating back to plugin installation.

Patch Information

At the time of NVD publication, no fixed version is listed for Responsive Posts Carousel Pro. Monitor the Patchstack advisory and the vendor's plugin page for an updated release that supersedes version 15.0, and apply the patch as soon as it ships.

Workarounds

Disable or remove the plugin until a patched release is available.
Deploy WAF rules that block path traversal sequences and absolute file paths in plugin request parameters.
Enforce open_basedir restrictions in PHP configuration to limit which directories included files may reside in.
Set allow_url_include = Off and allow_url_fopen = Off in php.ini to prevent escalation to remote file inclusion.

bash

# php.ini hardening to limit file inclusion exposure
allow_url_include = Off
allow_url_fopen = Off
open_basedir = "/var/www/html:/tmp"

# Example WAF rule (ModSecurity) blocking traversal in plugin requests
SecRule REQUEST_URI "@contains responsive-posts-carousel-pro" \
  "chain,phase:2,deny,status:403,id:1005272,log,msg:'CVE-2025-52728 LFI attempt'"
  SecRule ARGS "@rx (\.\./|/etc/|wp-config\.php|%00)" "t:none,t:urlDecodeUni"