CVE-2025-32150
Published: 04 April 2025
Summary
CVE-2025-32150 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 16.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-32150 is a PHP Local File Inclusion vulnerability (CWE-98) stemming from improper control of filenames in include/require statements. It affects the Real Estate Manager WordPress plugin by Rameez Iqbal, with all versions through 7.3 impacted. The flaw carries a CVSS 3.1 score of 7.5, reflecting network attack vectors with high complexity and low privileges required.
An authenticated attacker with low-privileged access can supply crafted input to force inclusion of arbitrary local files on the server. Successful exploitation can yield full control over confidentiality, integrity, and availability, potentially allowing reading of sensitive configuration files, execution of attacker-controlled code, or escalation to broader system compromise.
The sole reference points to a Patchstack advisory that catalogs the issue for the real-estate-manager plugin but provides no further mitigation details in the supplied data. The associated EPSS score remains flat at 0.0186 with no observed rise after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9870
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Rameez Iqbal Real Estate Manager real-estate-manager allows PHP Local File Inclusion.This issue affects Real Estate Manager: from n/a through <= 7.3.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.