CVE-2025-32146
Published: 04 April 2025
Summary
CVE-2025-32146 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Joomsky Js Job Manager. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 17.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-32146 is an improper control of filename for include/require statement vulnerability in PHP programs, described as PHP Remote File Inclusion but resulting in local file inclusion. It affects the JoomSky JS Job Manager plugin (js-jobs) for WordPress in versions through 2.0.2 and carries a CVSS 3.1 score of 8.8 along with CWE-98.
An authenticated attacker with low privileges can exploit the flaw over the network with low complexity and no user interaction to include arbitrary local files on the server. Successful exploitation can yield full confidentiality, integrity, and availability impact on the affected installation.
The single reference points to a Patchstack advisory entry for the plugin but supplies no explicit mitigation guidance or patch details in the available information. The associated EPSS score remains low, moving only from 0.0160 to a peak of 0.0241.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9866
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Job Manager js-jobs allows PHP Local File Inclusion.This issue affects JS Job Manager: from n/a through <= 2.0.2.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.