The vulnerability CVE-2025-23948 affects the Webarea Background animation blocks plugin (versions up to 2.1.5) and is caused by improper control over the filename parameter used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, where an attacker can manipulate the filename to include unintended local files on the server. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix details are provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files on the server, potentially leading to information disclosure, code execution, or denial of service. The high CVSS score indicates that the vulnerability can have a severe impact on the affected system's confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin to mitigate potential exploitation. Avoid exposing the affected plugin to untrusted users or networks. Monitor vendor channels for updates or patches addressing this vulnerability.