The vulnerability CVE-2025-47586 affects the StylemixThemes Motors - Events WordPress plugin up to version 1.4.7. It arises from improper control over the filename parameter used in PHP include or require statements, enabling a Local File Inclusion (LFI) attack. This can allow an attacker to include arbitrary files on the server, potentially leading to remote code execution or data disclosure. The CVSS 3.1 score of 9.0 reflects critical impact on confidentiality, integrity, and availability, though the attack complexity is high and no privileges or user interaction are required. No patch or official fix information is currently provided.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include and execute arbitrary local files on the server hosting the Motors - Events plugin. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability is rated critical with a CVSS score of 9.0. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor StylemixThemes communications for updates and apply any official patches promptly once available.