The vulnerability CVE-2025-25141 in zankover's Fami Sales Popup plugin arises from improper validation or control of filenames used in PHP include or require statements. This flaw allows PHP Local File Inclusion, where an attacker can cause the application to include unintended local files. The affected versions are from initial releases through 2.0.0. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to local file inclusion, which may expose sensitive files, enable code execution, or disrupt service availability. The impact is rated high due to the potential for full compromise of the affected system's confidentiality, integrity, and availability. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected Fami Sales Popup plugin to mitigate risk. Monitor vendor communications for updates on patches or official mitigations.