The vulnerability identified as CVE-2025-47653 in the tggfref WP-Recall plugin involves improper control of the filename parameter used in PHP include or require statements, classified under CWE-98. This flaw enables PHP Local File Inclusion, which can be exploited to include unintended files on the server. The affected versions include all versions up to 16.26.14. The CVSS v3.1 base score is 7.5, indicating a high severity with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts to confidentiality, integrity, and availability. No patch or official fix has been published yet, and the product is not a cloud service.

Successful exploitation of this vulnerability could allow an attacker with low privileges to include local files on the server, potentially leading to disclosure of sensitive information, modification of data, or disruption of service. The CVSS score of 7.5 reflects high impact on confidentiality, integrity, and availability. There are currently no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the affected plugin and monitor for updates from the vendor. No official fix or temporary workaround has been published at this time.