CVE-2025-32141
Published: 04 April 2025
Summary
CVE-2025-32141 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 17.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability CVE-2025-32141 is a PHP Local File Inclusion flaw caused by improper control of filenames in include/require statements within PHP code. It affects the MasterStudy LMS WordPress plugin (masterstudy-lms-learning-management-system) from Stylemix, impacting all versions through 3.5.28.
Authenticated attackers with low privileges can exploit the issue remotely without user interaction. Successful exploitation allows inclusion of arbitrary local files, resulting in high impacts to confidentiality, integrity, and availability on the target system.
The Patchstack advisory identifies the vulnerability in the plugin and links to corresponding remediation details for affected installations.
EPSS probability rose from a low baseline to a recorded peak of 0.0241, indicating modest but measurable post-disclosure interest in exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9880
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows PHP Local File Inclusion.This issue affects MasterStudy LMS: from n/a through <= 3.5.28.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.