The vulnerability CVE-2025-27011 in magepeopleteam Booking and Rental Manager arises from improper control over the filename parameter used in PHP include or require statements. This flaw allows a PHP Local File Inclusion attack, which can lead to unauthorized file access or code execution within the affected plugin versions (up to 2.2.8). The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, modification of application behavior, or denial of service. The high CVSS score reflects significant risk to confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

No official patch or remediation guidance is currently available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider restricting access to the affected plugin and monitor for updates from magepeopleteam. Avoid exposing the affected plugin to untrusted inputs that could exploit the include/require statements.