The vulnerability CVE-2025-23949 involves improper control of the filename parameter used in PHP include or require statements within the dzeriho Improved Sale Badges – Free Version plugin. This allows an attacker to perform PHP Local File Inclusion, which can lead to arbitrary code execution or information disclosure. The affected versions include all releases up to 1.0.1. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can result in an attacker including local files on the server, potentially leading to arbitrary code execution, data disclosure, or denial of service. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability of the affected system. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.