CVE-2025-39387 describes a vulnerability in wpoperations Opstore (<= 1.4.5) where improper control of the filename parameter in PHP include/require statements allows local file inclusion. This flaw can be exploited remotely over the network with high attack complexity and requires user interaction, but no privileges. Successful exploitation can lead to complete compromise of confidentiality, integrity, and availability of the system running the vulnerable software. The vulnerability has a CVSS 3.1 base score of 7.5 (high). No vendor patch or mitigation guidance is currently provided.

The vulnerability allows an attacker to include local files on the server via manipulated filename parameters, potentially exposing sensitive information, executing arbitrary code, or causing denial of service. The CVSS score indicates high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, so active exploitation is not confirmed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the vulnerable application, applying web application firewall rules to detect and block suspicious include/require requests, and limiting user interaction paths that could trigger the vulnerability. Monitor vendor channels for updates and patches.