The vulnerability identified as CVE-2025-26957 affects the Deetronix Affiliate Coupons plugin for PHP. It arises from improper control over the filename parameter used in include or require statements, resulting in a Local File Inclusion vulnerability. This allows an attacker with low privileges to potentially execute arbitrary code by including local files on the server. The issue affects versions up to and including 1.7.3. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges without user interaction. No patch or official remediation details are currently available.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized code execution, and disruption of service on affected systems running the vulnerable plugin. Given the high CVSS score and the nature of Local File Inclusion, attackers could leverage this flaw to escalate privileges or compromise the affected web server environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version, restricting access to the web application, or applying web application firewall rules to block attempts to exploit file inclusion. Monitor vendor channels for updates and apply patches promptly once available.