The vulnerability identified as CVE-2025-30635 affects ThemeAtelier's IDonatePro plugin through improper control of filenames in PHP include or require statements. This leads to a Local File Inclusion vulnerability, allowing an attacker to include and execute arbitrary files on the server. The issue impacts all versions up to and including 2.1.9. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available, and the product is not a cloud service, so remediation depends on vendor or user action.

Successful exploitation of this vulnerability can allow an attacker to execute arbitrary code on the server by including local files, potentially leading to full system compromise including data disclosure, modification, or denial of service. The high CVSS score (8.1) reflects the critical nature of the impact on confidentiality, integrity, and availability. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin to prevent exploitation. Monitoring for updates from ThemeAtelier is recommended to apply any forthcoming patches promptly.