The vulnerability CVE-2025-39592 affects the Subscribe to Unlock Lite plugin by WP Shuffle, specifically versions up to 1.3.0. It is caused by improper control of the filename parameter in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker with low privileges to include unintended files on the server, leading to high impact on confidentiality, integrity, and availability. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. There is no cloud service involved, and no patch or vendor advisory has been published yet.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, potentially exposing sensitive information, executing arbitrary code, or causing denial of service. The CVSS score of 7.5 indicates a high impact on confidentiality, integrity, and availability. Since the attacker requires only low privileges and no user interaction, the risk is significant for affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the Subscribe to Unlock Lite plugin if possible or restrict access to the plugin files to trusted users only. Monitor official WP Shuffle channels for updates and apply patches promptly once available.