CVE-2025-12851 is a Local File Inclusion vulnerability in the My auctions allegro WordPress plugin (wphocus project) affecting all versions up to 3.6.32. The vulnerability arises from improper control of the 'controller' parameter used in include/require statements, classified under CWE-98. This allows unauthenticated remote attackers to include arbitrary files on the server, leading to execution of arbitrary PHP code. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. The vulnerability enables bypassing access controls and executing malicious code via crafted requests.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the affected server, potentially leading to full compromise including data disclosure, modification, and denial of service. The vulnerability can bypass access controls and execute code even when file upload restrictions are in place, by including uploaded files with otherwise safe extensions. This poses a significant risk to the confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitoring for unusual file inclusion attempts and restricting web server permissions may reduce risk but do not fully mitigate the vulnerability.