The vulnerability CVE-2025-24766 affects the News Magazine X product by wproyal, specifically versions up to 1.2.37. It arises from improper control of the filename parameter in PHP include/require statements, leading to PHP Local File Inclusion. This can allow an attacker to include unintended files on the server, potentially resulting in code execution or information disclosure. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, which may lead to disclosure of sensitive information, execution of arbitrary code, and compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score reflects these severe impacts. However, there are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor wproyal's advisories for updates. Until a fix is available, consider restricting access to vulnerable endpoints and validating or sanitizing input parameters related to file inclusion to mitigate risk.