CVE-2025-52732: GMap Targeting LFI Vulnerability

CVE-2025-52732 Overview

CVE-2025-52732 is a PHP Local File Inclusion (LFI) vulnerability in the RealMag777 GMap Targeting WordPress plugin. The flaw affects all plugin versions up to and including 1.1.6. It stems from improper control of the filename used in PHP include or require statements, classified as [CWE-98]. Authenticated attackers with low privileges can exploit the issue over the network to include arbitrary local files on the server. Successful exploitation leads to disclosure of sensitive files, execution of attacker-controlled PHP code present on disk, and full compromise of the WordPress site.

Critical Impact

Authenticated attackers can execute arbitrary PHP code through local file inclusion, compromising confidentiality, integrity, and availability of the WordPress host.

Affected Products

• RealMag777 GMap Targeting plugin for WordPress
• All versions from initial release through 1.1.6
• WordPress sites running the gmap-targeting plugin

Discovery Timeline

• 2025-08-14 - CVE CVE-2025-52732 published to NVD
• 2026-04-23 - Last updated in NVD database

Technical Details for CVE-2025-52732

Vulnerability Analysis

The GMap Targeting plugin passes user-supplied input into a PHP file inclusion statement without proper validation or sanitization. PHP's include, include_once, require, and require_once functions load and execute the referenced file at runtime. When attacker-controlled input reaches these functions, the attacker can direct the server to load arbitrary files from the local filesystem.

The vulnerability requires low-privilege authenticated access, meaning any user account that can interact with the affected plugin endpoint is sufficient. Once exploited, the included file is parsed by the PHP interpreter, allowing disclosure of configuration files such as wp-config.php and execution of any PHP code residing in writable locations like upload directories or session files.

The EPSS probability for this CVE is 0.208% with a percentile of 43.02 as of 2026-05-25.

Root Cause

The root cause is improper control of the filename for an include or require statement [CWE-98]. The plugin accepts a parameter that influences the path passed to a PHP include function without applying an allowlist, canonicalization, or path validation. This permits traversal sequences and absolute paths that resolve to arbitrary local files.

Attack Vector

The attack vector is network-based and requires authentication. An attacker with a valid low-privileged WordPress account sends a crafted HTTP request to the vulnerable plugin endpoint. The request includes a manipulated parameter pointing to a target file path on the server. The plugin includes the file, leaking its contents or executing PHP code if the file contains valid PHP. Refer to the Patchstack Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-52732

Indicators of Compromise

• HTTP requests to GMap Targeting plugin endpoints containing path traversal sequences such as ../, encoded variants like %2e%2e%2f, or absolute filesystem paths.
• Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or PHP files in upload directories triggered by the gmap-targeting plugin.
• Web server logs showing gmap-targeting requests followed by anomalous PHP errors referencing include() or require() failures.

Detection Strategies

• Inspect WordPress access logs for parameters passed to plugin pages that contain filesystem paths or directory traversal patterns.
• Deploy web application firewall (WAF) rules that match local file inclusion patterns targeting WordPress plugin parameters.
• Monitor PHP error logs for failed to open stream or No such file or directory messages originating from the plugin's PHP files.

Monitoring Recommendations

• Alert on read access to wp-config.php and other sensitive WordPress files by the web server process outside of expected initialization paths.
• Track creation of new files in WordPress uploads/ directories followed by HTTP requests to the GMap Targeting plugin.
• Correlate authenticated WordPress sessions with anomalous parameter values targeting plugin endpoints.

How to Mitigate CVE-2025-52732

Immediate Actions Required

• Disable or remove the GMap Targeting plugin until a patched version is installed.
• Audit WordPress user accounts and revoke any unnecessary low-privileged accounts that could be abused for authenticated exploitation.
• Review web server and PHP logs for prior exploitation attempts referencing the gmap-targeting plugin paths.

Patch Information

No fixed version is identified in the available advisory data; all versions through 1.1.6 remain affected. Monitor the Patchstack Vulnerability Report and the WordPress.org plugin page for an official update from RealMag777. Apply the vendor patch as soon as it becomes available.

Workarounds

• Remove the plugin entirely from the WordPress installation if it is not business-critical.
• Restrict access to plugin endpoints using web server access controls or WAF rules that block requests containing path traversal sequences.
• Harden PHP configuration by setting open_basedir to confine file access to the WordPress document root and disabling allow_url_include.

# Example PHP hardening in php.ini
open_basedir = "/var/www/html/wordpress:/tmp"
allow_url_include = Off
allow_url_fopen = Off