CVE-2025-32137
WordPress s2Member plugin <= 250419 - Local File Inclusion vulnerability
Relative Path Traversal vulnerability in Cristián Lávaque s2Member s2member allows Path Traversal.This issue affects s2Member: from n/a through <= 250419.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
WordPress s2Member plugin <= 250419 - Local File Inclusion vulnerability
Relative Path Traversal vulnerability in Cristián Lávaque s2Member s2member allows Path Traversal.This issue affects s2Member: from n/a through <= 250419.
- Record
CVE-2025-32137- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-23
- Updated
- 2026-11-02
EUVDEUVD-2025-9883
Relative Path Traversal vulnerability in Cristián Lávaque s2Member s2member allows Path Traversal.This issue affects s2Member: from n/a through <= 250419.
- Record
EUVD-2025-9883- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-292w-2m2h-rw25
Relative Path Traversal vulnerability in Cristián Lávaque s2Member allows Path Traversal. This...
Relative Path Traversal vulnerability in Cristián Lávaque s2Member allows Path Traversal. This issue affects s2Member: from n/a through 250214.
- Record
GHSA-292w-2m2h-rw25- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-23
- Updated
- 2026-11-02
NVD
Relative Path Traversal vulnerability in Cristián Lávaque s2Member s2member allows Path Traversal.This issue affects s2Member: from n/a through <= 250419.
- Record
CVE-2025-32137- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-23
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-32137 is a medium vulnerability (CVSS 4.9) in Cristián Lávaque S2member, published April 4, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.80%, the 56th percentile. No source names a fixed version.
References
patchstack.com/database/Wordpress/Plugin/s2member/vulnerability/wordpress-s2member-plugin-250214-local-file-inclusion-vulnerability?_s_id=cve
nvd.nist.gov/vuln/detail/CVE-2025-32137
github.com/advisories/GHSA-292w-2m2h-rw25