The vulnerability identified as CVE-2025-47439 affects the WP Chill Download Monitor plugin for WordPress (versions up to 5.0.22). It is caused by improper control of the filename parameter used in PHP include or require statements, which allows a PHP Local File Inclusion attack. This can enable an attacker with low privileges to include arbitrary files on the server, potentially leading to remote code execution or data disclosure. The CVSS v3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no user interaction required.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could include arbitrary files on the server, potentially executing malicious code or accessing sensitive information. The vulnerability requires low privileges but has high attack complexity. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin and monitor for suspicious activity. Avoid exposing the affected system to untrusted networks. Follow WP Chill's official channels for updates regarding patches or mitigations.