The vulnerability CVE-2025-32152 affects the Essential Plugin Slider a SlidersPack up to version 2.3. It involves improper control over the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This can allow attackers with low privileges to include local files, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 score is 7.5, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation guidance has been provided yet, and no exploits are currently known in the wild.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the server running the vulnerable plugin. This can lead to full compromise of the affected system, including unauthorized disclosure of sensitive data, modification of data, and disruption of service. The high CVSS score reflects these severe impacts. However, no active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version if feasible. Monitor vendor channels and trusted security sources for updates and apply patches promptly once available.