CVE-2025-32158
📋 TL;DR
This vulnerability allows attackers to include arbitrary PHP files from remote servers in the aThemes Addons for Elementor WordPress plugin. Attackers can execute malicious code on affected WordPress sites, potentially taking full control. All WordPress installations using vulnerable versions of this plugin are affected.
💻 Affected Systems
- aThemes Addons for Elementor WordPress plugin
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise leading to data theft, ransomware deployment, or website defacement through remote code execution.
Likely Case
Website defacement, data exfiltration, or installation of backdoors for persistent access.
If Mitigated
Limited impact if proper file permissions, web application firewalls, and input validation are in place.
🎯 Exploit Status
Remote file inclusion vulnerabilities are commonly exploited and require minimal technical skill.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 1.0.16 or later
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find 'aThemes Addons for Elementor'. 4. Click 'Update Now' if available. 5. If no update appears, manually download version 1.0.16+ from WordPress.org and replace the plugin files.
🔧 Temporary Workarounds
Disable vulnerable plugin
allTemporarily deactivate the aThemes Addons for Elementor plugin until patched.
wp plugin deactivate athemes-addons-for-elementor
Web Application Firewall rule
linuxBlock requests containing suspicious file inclusion patterns.
ModSecurity rule: SecRule ARGS "@rx (?:\\.\\.|php://|http://|ftp://)" "id:1001,phase:2,deny,status:403"
🧯 If You Can't Patch
- Remove the plugin entirely and find alternative Elementor addons
- Implement strict file permissions (755 for directories, 644 for files) and disable allow_url_include in php.ini
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > aThemes Addons for Elementor version. If version is 1.0.15 or lower, you are vulnerable.Check Version:
wp plugin get athemes-addons-for-elementor --field=versionVerify Fix Applied:
Verify plugin version is 1.0.16 or higher in WordPress admin panel.📡 Detection & Monitoring
Log Indicators:
- Unusual PHP include/require statements in web server logs
- Requests with suspicious parameters like ?file=http://malicious.com/shell.php
Network Indicators:
- Outbound connections to unexpected domains following suspicious requests
- Unusual file upload patterns
SIEM Query:
source="web_server.log" AND ("include" OR "require") AND ("http://" OR "ftp://" OR "php://")