The vulnerability CVE-2025-25109 in JoomSky WP Vehicle Manager (<= 3.1) is caused by improper validation of filenames used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, allowing attackers to execute arbitrary local files on the server. The issue affects the PHP code handling file inclusion within the plugin, potentially enabling remote attackers to compromise the system. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation details are currently available from the vendor or other sources.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the server hosting the vulnerable WP Vehicle Manager plugin. This can lead to full system compromise, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The high CVSS score (8.1) reflects the critical nature of the impact. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the WP Vehicle Manager plugin if feasible. Monitoring for updates from JoomSky is recommended to apply any official patches promptly once available. No vendor advisory or patch links are currently provided.