The vulnerability CVE-2025-39452 affects the Arraytics WPCafe plugin for WordPress up to version 2.2.32. It arises from improper validation or control of filenames used in PHP include or require statements, enabling an attacker to perform Local File Inclusion (LFI). This can allow unauthorized reading of local files or potentially executing arbitrary code depending on the environment. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring low privileges and high attack complexity.

Successful exploitation of this vulnerability can lead to disclosure of sensitive local files, modification of application behavior, and potentially full system compromise. The CVSS vector indicates high impact on confidentiality, integrity, and availability, meaning attackers could read sensitive data, alter files, or disrupt service. However, exploitation requires low privileges and no user interaction but has high attack complexity, which may limit widespread exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected WPCafe plugin version. Monitoring vendor channels for updates is recommended. No specific temporary mitigations are provided in the available data.