The vulnerability CVE-2025-47693 in roninwp FAT Services Booking plugin arises from improper control of the filename parameter used in PHP include or require statements, enabling Local File Inclusion. This flaw allows an attacker with low privileges and no user interaction to potentially execute arbitrary code or access sensitive files on the server. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring high attack complexity. The issue affects all versions up to 5.5 of the plugin. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS score of 7.5 indicates a high impact on confidentiality, integrity, and availability. No known exploits are reported in the wild, but the vulnerability presents a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, restrict access to the affected plugin and consider disabling it if possible. Monitor for updates from roninwp regarding an official fix.