Testimonial Slider Pro CVE-2025-32657

Exploitation requires a valid low-privileged authenticated WordPress account on a site running Testimonial Slider And Showcase Pro version 2.1.7 or earlier (PR:L - this is not anonymous/pre-auth). The core prerequisite is reaching the plugin code path that passes attacker-influenced input into a PHP include/require statement (CWE-98), then supplying a traversable path or PHP stream filter chain to a local file. Limiting factors: the CVSS high attack complexity (AC:H) indicates a specific, non-default payload or condition must be met rather than a trivial parameter swap; the requirement for an authenticated account further narrows exposure to sites that allow user registration or have multiple editorial users. No end-user interaction is required (UI:N).

This is a moderate-priority, not top-tier, vulnerability. The CVSS 3.1 base score of 7.5 is driven by high confidentiality/integrity/availability impact (C:H/I:H/A:H), but two metrics meaningfully constrain real-world risk: AC:H (high attack complexity, implying a non-trivial precondition such as a specific filter-chain or path-traversal technique) and PR:L (a low-privileged authenticated account is required, not anonymous access). The EPSS score is low at 0.61% (48th percentile), indicating no statistical signal of imminent mass exploitation. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is 'no public exploit identified at time of analysis.' The signals are internally consistent: low EPSS, no KEV, no POC, authentication requirement, and high complexity all point toward a flaw that is serious if reached but not currently a widespread or trivially weaponizable target. One point to verify: the CVSS reflects full CIA impact (consistent with PHP Local File Inclusion escalating to code execution via included PHP, e.g., log poisoning), yet the vendor tags label it 'Information Disclosure' (read-only) - this is a mild conflict between the impact metrics and the tag; defenders should confirm whether exploitation yields only file disclosure or full RCE.

An attacker who holds a low-privileged authenticated WordPress account (e.g., a subscriber/contributor on a multi-user site) submits a crafted request to the Testimonial Slider And Showcase Pro plugin that manipulates a filename passed into a PHP include/require statement. By supplying a traversal path or PHP filter chain, they read sensitive local files (such as wp-config.php) or, if a controllable PHP source can be included, execute code on the server. No public exploit code is identified at this time, and the high attack complexity (AC:H) means a reliable attack requires crafting a specific inclusion payload.