The vulnerability identified as CVE-2025-32692 affects WP Shuffle's WP Subscription Forms plugin up to version 1.2.4. It involves improper control over the filename parameter used in PHP include or require statements, resulting in a PHP Local File Inclusion vulnerability. This can allow an attacker with limited privileges to include arbitrary files on the server, potentially leading to remote code execution or information disclosure. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch information available at this time, and the vulnerability is not related to a cloud service.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to execute arbitrary code, access sensitive files, or disrupt service on affected installations of WP Subscription Forms plugin versions up to 1.2.4. The high CVSS score indicates a serious risk to confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected WP Subscription Forms plugin versions to mitigate risk. Monitor official WP Shuffle communications and trusted vulnerability databases for updates or patches addressing this vulnerability.