The vulnerability CVE-2025-30835 in the Bastien Ho Accounting for WooCommerce plugin arises from improper control over the filename parameter used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), potentially leading to arbitrary code execution or information disclosure. The affected versions include all releases up to 1.6.8. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available from the vendor or other sources.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the affected server, potentially leading to full compromise of the system, including unauthorized access to sensitive data, code execution, and disruption of service. The high CVSS score reflects the severity of these impacts. However, there are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the vulnerable plugin, applying access controls to limit exposure, and monitoring for suspicious activity related to file inclusion attempts. Avoid exposing the affected plugin to untrusted users or inputs. Follow vendor channels closely for updates.