CVE-2025-32663 is a vulnerability in the roninwp FAT Cooming Soon WordPress plugin (versions up to 1.1) caused by improper control of filenames in PHP include or require statements. This leads to a Local File Inclusion vulnerability, allowing attackers to include arbitrary files on the server. The vulnerability has a CVSS 3.1 base score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector with high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no exploits are known in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. However, no known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.