The vulnerability CVE-2025-31387 in InstaWP Connect arises from improper validation or control of filenames passed to PHP include or require statements, resulting in a Local File Inclusion (LFI) flaw. This can enable an attacker to include arbitrary files from the local filesystem, potentially leading to remote code execution or disclosure of sensitive information. The affected versions are from initial releases through 0.1.0.82. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to an attacker including local files on the server, which may result in disclosure of sensitive information, code execution, or full system compromise. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is available, users should consider restricting access to the vulnerable component and applying general PHP security best practices to limit exposure.