CVE-2025-32153
Published: 04 April 2025
Summary
CVE-2025-32153 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 16.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-32153 is an improper control of filename for include/require statement vulnerability, categorized as PHP Remote File Inclusion but resulting in PHP Local File Inclusion, present in the vinagecko VG WooCarousel WordPress plugin. The flaw affects all versions through 1.3 and is tracked under CWE-98, carrying a CVSS 3.1 score of 7.5.
The issue can be exploited over the network by an authenticated attacker with low privileges and without user interaction. Successful exploitation allows the attacker to include arbitrary local files, resulting in high impact to confidentiality, integrity, and availability on the affected WordPress installation.
The sole reference points to a Patchstack advisory that documents the vulnerability in the VG WooCarousel plugin; administrators should consult that entry for available updates or configuration guidance. The associated EPSS score remains flat at 0.0186 with no observed increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9864
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in vinagecko VG WooCarousel vg-woocarousel allows PHP Local File Inclusion.This issue affects VG WooCarousel: from n/a through <= 1.3.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.