CVE-2025-39468 is a remote file inclusion vulnerability in the pantherius Modal Survey plugin for PHP. The issue arises from improper validation or control of filenames used in include or require statements, allowing an attacker to supply a remote file that the application then executes. This can lead to full compromise of the affected system, including unauthorized code execution and potential data breaches. The vulnerability affects Modal Survey versions up to 2.0.2.0.1. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating network attack vector, high attack complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently available.

Successful exploitation of this vulnerability allows remote attackers to execute arbitrary code on the affected system by including malicious remote files. This compromises confidentiality, integrity, and availability of the system running the Modal Survey plugin. Given the high CVSS score and the nature of remote file inclusion, the impact is severe and can lead to full system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable Modal Survey plugin to prevent exploitation. Monitor vendor channels for updates and apply patches promptly once available.