The vulnerability identified as CVE-2025-32137 is a Relative Path Traversal issue in the s2Member plugin developed by Cristián Lávaque. It affects versions up to and including 250419. The flaw allows an attacker with high privileges to traverse directories by manipulating relative paths, potentially accessing sensitive files outside the intended directory scope. The CVSS 3.1 vector indicates network attack vector, low attack complexity, required privileges are high, no user interaction needed, unchanged scope, high confidentiality impact, no integrity or availability impact. No patch or official remediation information is provided in the available data.

An attacker with high privileges could exploit this vulnerability to read sensitive files outside the intended directory structure, potentially exposing confidential information. There is no indication of integrity or availability impact. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict high privilege access to trusted users only and monitor for suspicious activity related to file access. Avoid exposing the vulnerable plugin to untrusted networks or users with elevated privileges.