The vulnerability CVE-2025-39411 affects the WhatsApp Click to Chat Plugin for WordPress by Indie_Plugins, specifically versions up to 2.2.12. It is caused by improper control over the filename parameter in PHP include or require statements, enabling remote file inclusion. This allows attackers to potentially execute arbitrary code remotely by including malicious files. The CVSS 3.1 base score is 7.5, reflecting high impact with network attack vector, high attack complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented yet, and the plugin is not a cloud service, so remediation depends on vendor updates.

Successful exploitation of this vulnerability could lead to remote code execution on the affected WordPress site, compromising confidentiality, integrity, and availability of the system. This could allow attackers to execute arbitrary code, potentially leading to full system compromise. However, there are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor official Indie_Plugins communications for updates and apply patches promptly once available.