CVE-2025-32155

Deeper analysis

CVE-2025-32155 is an improper control of filename for include/require statement vulnerability, also described as PHP Remote File Inclusion that permits PHP Local File Inclusion, present in the Beds24 Online Booking WordPress plugin. The flaw affects all versions through 2.0.28 and is tracked under CWE-98. It carries a CVSS 3.1 score of 7.5 reflecting network attack vector, high attack complexity, low privileges required, and high impact on confidentiality, integrity, and availability.

An authenticated attacker with low privileges can supply a crafted filename to an include or require statement, resulting in the inclusion of arbitrary local files on the server. Successful exploitation can lead to disclosure of sensitive information, modification of files, or execution of attacker-controlled code within the PHP context.

The sole reference points to a Patchstack advisory entry for the plugin, which documents the issue but provides no further mitigation details in the supplied data. The associated EPSS score remains flat at 0.0159 with no material increase after disclosure.