CVE-2025-14475 is a Local File Inclusion vulnerability in the Extensive VC Addons for WPBakery page builder plugin for WordPress, affecting all versions up to and including 1.9.1. The issue stems from improper control of the filename used in an include/require statement within the extensive_vc_get_module_template_part function. Specifically, the shortcode_name parameter in the extensive_vc_init_shortcode_pagination AJAX action lacks sufficient path normalization and validation, enabling unauthenticated attackers to include arbitrary PHP files on the server and execute their code.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the affected server, potentially leading to full compromise of the web application and underlying system. The vulnerability impacts confidentiality, integrity, and availability, as indicated by the CVSS vector (C:H/I:H/A:H). No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or restricting access to the vulnerable AJAX action if possible to reduce exposure.