The vulnerability CVE-2025-31405 affects the zankover Fami WooCommerce Compare plugin for WooCommerce, specifically versions up to and including 1.0.5. It arises from improper control over the filename parameter used in PHP include or require statements, enabling PHP Local File Inclusion (LFI). This can allow an attacker to include arbitrary files on the server, potentially leading to disclosure of sensitive information or remote code execution depending on the server configuration. The CVSS 3.1 base score is 7.5, with network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, potentially exposing sensitive information or enabling further attacks that compromise the system's confidentiality, integrity, and availability. The high CVSS score reflects the serious impact this vulnerability can have if exploited.

No official patch or remediation is currently available from the vendor. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor vendor communications for updates on patches or mitigations.