CVE-2025-32137 MEDIUM

CVE-2025-32137: WordPress s2Member plugin <= 250419 - Local File Inclusion vulnerability

Vendor Cristián Lávaque

Product s2Member

Weakness CWE-23

Published April 4, 2025

Last update April 28, 2026

View on NVD All CVEs

CVSS base score

4.9/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

What the vulnerability does

01Description

Relative Path Traversal vulnerability in Cristián Lávaque s2Member s2member allows Path Traversal.This issue affects s2Member: from n/a through <= 250419.

Explanation of Vulnerability in Simple Terms

02Summary

s2Member contains a path traversal vulnerability that allows high-privilege users to read sensitive files on the server. An attacker with administrative access can bypass directory restrictions and access files outside the intended scope. The vulnerability requires high-level privileges to exploit and does not affect file modification or system availability.

What an attacker can do

03Attacker Capabilities

Read sensitive files outside the intended directory with administrative access.

Potential impact on your site

04Site Impact

Administrators with malicious intent or compromised admin accounts can access sensitive server files.

Conditions required to exploit

05Prerequisites

Attacker must have high-level administrative privileges on the site.

Key dates

06Disclosure timeline

April 4, 2025 CVE published

April 28, 2026 Record updated

External resources

07References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2025-32137 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/23.html AskarLabs — CWE-23 write-up Relative Path Traversal

Related vulnerabilities