CVE-2025-32663
Published: 11 April 2025
Summary
CVE-2025-32663 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, ranked in the top 21.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is a PHP Local File Inclusion issue, tracked as CWE-98, in the FAT Cooming Soon WordPress plugin developed by roninwp. It stems from improper control of filenames in include/require statements and affects all versions through 1.1. The flaw received a CVSS 3.1 score of 8.1.
An unauthenticated remote attacker can exploit the weakness over the network without user interaction. Successful exploitation allows the attacker to include arbitrary local files, resulting in high impacts to confidentiality, integrity, and availability on the affected site.
The issue is catalogued in the Patchstack vulnerability database, which serves as the primary advisory reference for this plugin flaw. No specific patch or mitigation steps are detailed in the available references beyond the disclosure entry itself.
EPSS scores remain low, with a current value of 0.0115 and a peak of 0.0199.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10740
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in roninwp FAT Cooming Soon fat-coming-soon allows PHP Local File Inclusion.This issue affects FAT Cooming Soon: from n/a through <= 1.1.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.