The vulnerability identified as CVE-2025-46454 affects the svil4ok Meta Keywords & Description WordPress plugin versions up to 0.8. It involves improper control of the filename parameter used in PHP include or require statements, enabling a local file inclusion vulnerability. This can allow an attacker to include and execute arbitrary files on the server, potentially leading to full system compromise. The CVSS 3.1 vector indicates the attack requires network access, high attack complexity, no privileges, and user interaction, with impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to execute arbitrary code or access sensitive files on the affected server. This results in high impact on confidentiality, integrity, and availability of the system running the vulnerable plugin. The attack requires user interaction and has high complexity, which may limit exploitation but does not eliminate risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable plugin to prevent exploitation. Monitor for updates from the vendor or trusted security sources for patches or further mitigation instructions.