The vulnerability CVE-2025-32672 affects the Ultimate Bootstrap Elements for Elementor plugin by g5theme, allowing improper control over the filename parameter in PHP include/require statements. This improper control leads to a Local File Inclusion vulnerability, where an attacker can cause the application to include unintended files, potentially executing arbitrary code or accessing sensitive data. The issue impacts versions up to 1.4.9. The CVSS v3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information currently available.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to execute arbitrary code or access sensitive files on the server. This can result in complete compromise of the affected system's confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to the affected plugin, disable or remove it if possible, and monitor for updates from the vendor. Avoid exposing the vulnerable component to untrusted networks or users.