The vulnerability identified as CVE-2025-39391 affects the zamartz Checkout Field Visibility for WooCommerce plugin, specifically versions up to 1.3.0. It involves improper control over the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion vulnerability. This can allow an attacker to include arbitrary files from the server, potentially exposing sensitive information or enabling further attacks. The issue is due to inadequate validation of input controlling file inclusion.

Successful exploitation of this vulnerability could allow an attacker to read local files on the server by including them via the vulnerable include/require statement. This may lead to disclosure of sensitive information or facilitate further compromise depending on the files accessible. There are no reports of active exploitation in the wild. The impact is limited to local file inclusion, not remote code execution, based on the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider disabling or removing the affected plugin if feasible to reduce risk.