The vulnerability CVE-2025-24733 in Post Grid Master plugin arises from improper validation of filenames used in PHP include or require statements in the ajax-filter-posts feature. This improper control enables PHP Local File Inclusion, allowing an attacker with low privileges to include local files on the server. The CVSS score is 6.5 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, high confidentiality impact, and no impact on integrity or availability. The affected versions are up to 3.4.12. No patch or vendor advisory is currently provided.

An attacker with low privileges can exploit this vulnerability remotely to include local files on the server, potentially disclosing sensitive information. The impact is limited to confidentiality; integrity and availability are not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch or official fix is available, restrict access to the vulnerable ajax-filter-posts functionality and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the plugin to untrusted users. Follow vendor updates closely for any forthcoming patches.