CVE-2025-32692
Published: 09 April 2025
Summary
CVE-2025-32692 is a high-severity PHP Remote File Inclusion (CWE-98) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 17.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-32692 is an improper control of filename for include/require statements vulnerability, categorized as PHP Remote File Inclusion that permits PHP Local File Inclusion. It affects the WP Subscription Forms plugin by WP Shuffle, impacting all versions through 1.2.4 on WordPress sites. The flaw carries a CVSS 3.1 score of 7.5 and is tracked under CWE-98.
An attacker with low-privileged network access and no user interaction required can supply crafted filenames to force inclusion of arbitrary local files. Successful exploitation grants full control over confidentiality, integrity, and availability of the affected WordPress installation, enabling potential code execution or sensitive data exposure depending on the included file contents.
The issue is documented in the Patchstack vulnerability database, which serves as the primary advisory reference for this CVE. The associated EPSS score remains low, with a current value of 0.0160 and a peak of 0.0241, indicating limited observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-10553
Vulnerability details
Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in WP Shuffle WP Subscription Forms wp-subscription-forms allows PHP Local File Inclusion.This issue affects WP Subscription Forms: from n/a through <= 1.2.4.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.