The vulnerability CVE-2025-22279 affects Crocoblock's JetCompareWishlist plugin up to version 1.5.9. It arises from improper control over the filename parameter used in PHP include or require statements, leading to a Local File Inclusion (LFI) vulnerability. This can allow an attacker with low privileges and no user interaction to cause high impact on confidentiality, integrity, and availability by including unintended files in the PHP execution context. The CVSS vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and high impact on all security properties.

Successful exploitation of this vulnerability can result in arbitrary code execution, disclosure of sensitive information, and disruption of service on the affected system. Since it is a Local File Inclusion issue, attackers may read or execute files on the server, potentially leading to full system compromise depending on the environment and configuration.

No official patch or remediation is currently available for this vulnerability. Users of JetCompareWishlist should monitor the vendor's advisories for updates and consider applying workarounds such as restricting file inclusion paths or disabling the vulnerable functionality if possible. Until a fix is released, minimizing exposure by limiting access to the affected plugin and applying strict input validation may reduce risk.