CVE-2025-3703 describes a PHP Local File Inclusion vulnerability in the wipeoutmedia CSS & JavaScript Toolbox plugin for WordPress, present in versions before 12.0.3. The vulnerability arises from improper control over the filename parameter used in PHP include or require statements, which can be manipulated to include local files. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and low privileges required. The vulnerability does not require user interaction and affects the plugin when installed on a server running PHP.

Successful exploitation of this vulnerability could allow an attacker to include arbitrary local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score of 7.5 indicates a high impact on confidentiality, integrity, and availability. However, no known exploits are reported in the wild, and the attack complexity is high, which may limit immediate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official advisories are provided, users should monitor wipeoutmedia's official channels for updates. Until a fix is available, consider disabling or removing the CSS & JavaScript Toolbox plugin if it is not essential, or restrict access to the affected functionality to trusted users only.