CVE-2025-32304: 
WordPress vulnerability analysis and mitigation

CVE-2025-32304 is a PHP Local File Inclusion (LFI) vulnerability in the Mojoomla WPCHURCH WordPress plugin, affecting all versions through 2.7.0. The flaw is classified under CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program). It was reported by Patchstack and first published on January 6, 2026. The vulnerability carries a CVSS v3.1 base score of 8.1 (High), assigned by Patchstack (Patchstack).

The root cause is improper control of filenames used in PHP include or require statements within the WPCHURCH plugin (CWE-98), which allows an attacker to manipulate file path parameters to include arbitrary local files. The attack vector is network-based, requires no authentication or user interaction, but is rated as high complexity, suggesting some precondition or non-trivial exploitation step is required. By supplying a crafted filename or path parameter, an attacker can cause the PHP interpreter to include sensitive local files such as configuration files, potentially exposing credentials or enabling further code execution (Patchstack).

Successful exploitation can result in high confidentiality, integrity, and availability impacts. An attacker could read sensitive local files (e.g., WordPress wp-config.php containing database credentials), potentially execute arbitrary PHP code if writable files or upload directories are accessible, and disrupt service availability. Credential exposure from configuration files could enable lateral movement to the underlying database or other connected systems (Patchstack).

As of the available data, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation. The EPSS score is approximately 0.066%, indicating a low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Patchstack).

1. Reconnaissance: Identify WordPress sites running the WPCHURCH (church-management) plugin version 2.7.0 or earlier using tools like WPScan, Shodan, or by inspecting plugin directories exposed via HTTP.
2. Identify vulnerable parameter: Analyze the plugin's PHP source code or HTTP requests to locate parameters passed to include() or require() statements without proper sanitization.
3. Craft malicious request: Construct an HTTP request (GET or POST) targeting the vulnerable endpoint, supplying a manipulated filename parameter (e.g., path traversal sequences like ../../wp-config.php) to reference a sensitive local file.
4. Trigger file inclusion: Submit the crafted request to the WordPress site; if successful, the server-side PHP interpreter includes and potentially outputs the contents of the targeted file.
5. Extract sensitive data: Parse the server response for exposed credentials, configuration data, or other sensitive information from included files, enabling further attack steps such as database access or privilege escalation.

• Network: Unusual HTTP requests to WPCHURCH plugin endpoints containing path traversal sequences (e.g., ../, ..%2F, %2e%2e%2f) in query parameters or POST body.
• Logs: WordPress or web server access logs showing requests with encoded path traversal patterns targeting plugin-specific PHP files; repeated 200 responses to atypical plugin endpoints.
• File System: Unexpected access to sensitive files such as wp-config.php, /etc/passwd, or other system files by the web server process.
• Process: PHP error logs showing include() or require() failures referencing unusual file paths outside the plugin directory.

No official patch has been confirmed as available for WPCHURCH beyond version 2.7.0 based on current data. Administrators should immediately audit installations running WPCHURCH ≤ 2.7.0 and consider disabling or removing the plugin until a patched version is released. Interim mitigations include implementing Web Application Firewall (WAF) rules to block path traversal patterns, restricting file system permissions so the web server process cannot read sensitive files outside the web root, and enforcing strict input validation on any parameters used in file inclusion operations (Patchstack).

The vulnerability was noted in the Wordfence Intelligence Weekly WordPress Vulnerability Report for May 12–18, 2025, indicating it received standard coverage in the WordPress security community (Wordfence). Social media mentions were observed on Mastodon and Bluesky from security-focused accounts, but no significant researcher commentary or vendor statements beyond the Patchstack disclosure have been identified.