The vulnerability CVE-2025-32157 in the Sparkle Elementor Kit plugin arises from improper validation or control of filenames used in PHP include or require statements. This can lead to Local File Inclusion, where an attacker may include unintended files on the server, potentially exposing sensitive information or enabling further code execution. The vulnerability affects all versions up to 2.0.9. The CVSS v3.1 score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring low privileges and high attack complexity. No vendor patch or advisory is currently available.

Successful exploitation of this vulnerability could allow an attacker to read local files on the server, potentially exposing sensitive data, and may lead to code execution or denial of service. The CVSS score of 7.5 indicates a high impact on confidentiality, integrity, and availability. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected Sparkle Elementor Kit plugin versions or applying manual code review and hardening to restrict file inclusion paths. Monitor vendor channels for updates and patches.