CVE-2025-32627
Published: 11 April 2025
Summary
CVE-2025-32627 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability in Joomsky Js Job Manager. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 21.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-32627 is a PHP Local File Inclusion vulnerability (CWE-98) arising from improper control of filenames in include/require statements. It affects the JoomSky JS Job Manager plugin (js-jobs) for WordPress in all versions through 2.0.2.
An unauthenticated remote attacker can exploit the flaw over the network with high attack complexity to read or execute arbitrary local files on the server. Successful exploitation can result in disclosure of sensitive information, modification of application behavior, or full compromise of confidentiality, integrity, and availability.
The sole referenced advisory from Patchstack documents the issue in the JS Job Manager plugin but provides no additional mitigation details beyond the vulnerability record itself. The associated EPSS score remains low, with only a modest increase from an initial value to a peak of 0.0187.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10746
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in JoomSky JS Job Manager js-jobs allows PHP Local File Inclusion.This issue affects JS Job Manager: from n/a through <= 2.0.2.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.