CVE-2025-32152
Published: 04 April 2025
Summary
CVE-2025-32152 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 17.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-32152 is a PHP Local File Inclusion vulnerability arising from improper control of filenames in include/require statements. It affects the Slider a SlidersPack plugin (sliderspack-all-in-one-image-sliders) for WordPress, impacting all versions through 2.3. The flaw is tracked under CWE-98 and carries a CVSS 3.1 score of 7.5.
An attacker with low-privileged network access can supply crafted input to force inclusion of arbitrary local files on the server. Successful exploitation can yield full read access to sensitive files along with the ability to alter or delete data and disrupt service availability, though the attack requires specific conditions reflected in the CVSS vector.
The public Patchstack advisory documents the issue and identifies the affected plugin versions, directing administrators to apply vendor updates once released. The associated EPSS score has remained flat at 0.0159 with no observed increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9865
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Essential Plugin Slider a SlidersPack sliderspack-all-in-one-image-sliders allows PHP Local File Inclusion.This issue affects Slider a SlidersPack: from n/a through <= 2.3.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.