The vulnerability CVE-2025-48292 in GoodLayers Tourmaster plugin arises from improper validation of filenames used in PHP include or require statements. This weakness enables PHP Local File Inclusion, which can be exploited remotely to include arbitrary files on the server. The affected versions are all up to 5.3.8. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to unauthorized local file inclusion on the server hosting the Tourmaster plugin. This may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service, impacting confidentiality, integrity, and availability of the affected system. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor GoodLayers' communications for updates. Until a fix is available, consider disabling or restricting access to the vulnerable plugin to mitigate risk.