The vulnerability CVE-2025-26760 affects Wow-Company Calculator Builder up to version 1.6.2 and is caused by improper control of filenames used in PHP include or require statements. This improper control enables PHP Local File Inclusion, allowing an attacker to include and execute local files on the server. The CVSS v3.1 base score is 7.5, reflecting a high severity with network attack vector, high attack complexity, no privileges required, user interaction required, and full impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, modification of application behavior, and denial of service conditions due to the Local File Inclusion flaw. The attacker can potentially execute arbitrary code or access sensitive files on the server hosting Calculator Builder, severely impacting system security.

No official patch or remediation is currently available for this vulnerability. Users of Wow-Company Calculator Builder should monitor the vendor's advisories for updates. Until a fix is released, consider restricting access to the affected application and applying web application firewall (WAF) rules to detect and block attempts to exploit file inclusion. Avoid exposing the application to untrusted users or networks.