The vulnerability identified as CVE-2025-46468 affects WPFable Fable Extra versions up to 1.0.6. It is caused by improper control of the filename used in PHP include or require statements, leading to a Local File Inclusion (LFI) vulnerability. This allows an attacker to include and execute arbitrary local files on the server, potentially resulting in full system compromise. The CVSS v3.1 base score is 9.8, reflecting critical impact with network attack vector, no privileges or user interaction needed, and full confidentiality, integrity, and availability impact. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to arbitrary code execution on the affected server, complete disclosure of sensitive information, and disruption or denial of service. The critical CVSS score of 9.8 indicates that the vulnerability can be exploited remotely without authentication or user interaction, posing a severe risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to vulnerable functionality if possible. Monitor official WPFable advisories for updates and apply patches promptly once available. No vendor advisory or patch links are currently provided.