Themekraft BuddyForms versions up to 2.9.0 contain a vulnerability classified as CVE-2025-32151, characterized by improper control of filenames in PHP include/require statements. This leads to a PHP Local File Inclusion vulnerability, which can be exploited to include and execute local files on the server. The vulnerability has a CVSS v3.1 score of 7.5, with network attack vector, high impact on confidentiality, integrity, and availability, and requires low privileges without user interaction. No patch or official remediation has been disclosed yet.

Successful exploitation of this vulnerability could allow an attacker with low privileges to execute arbitrary code or access sensitive files on the server hosting BuddyForms. This compromises confidentiality, integrity, and availability of the affected system. There are no known active exploits in the wild at the time of this report.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to the affected plugin and monitor for updates from Themekraft. Avoid exposing the vulnerable plugin to untrusted users or networks.