CVE-2025-32157
Published: 04 April 2025
Summary
CVE-2025-32157 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 20.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-32157 is a PHP Local File Inclusion vulnerability (CWE-98) in the Sparkle Elementor Kit WordPress plugin, affecting all versions through 2.0.9. The flaw stems from improper control of filenames passed to include/require statements, allowing an attacker to supply arbitrary local paths that the PHP interpreter will execute or expose.
An authenticated attacker with low privileges can trigger the issue over the network. Because the CVSS vector specifies high attack complexity but no user interaction and full impact on confidentiality, integrity, and availability, successful exploitation can result in arbitrary file reads, configuration disclosure, or execution of attacker-controlled PHP code within the WordPress context.
The single reference points to a Patchstack advisory that catalogs the vulnerability for the affected plugin versions; no additional vendor-supplied patch details or mitigation steps are provided in the available data. The associated EPSS score remains flat at 0.0122 with no observed increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9863
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Jakub Glos Sparkle Elementor Kit sparkle-elementor-kit allows PHP Local File Inclusion.This issue affects Sparkle Elementor Kit: from n/a through <= 2.0.9.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.