This vulnerability (CVE-2025-48298) in SEOPress for MainWP arises from improper validation or control of filenames used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This flaw affects versions up to 1.4 of the plugin. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity and no privileges. The vulnerability allows an attacker to include local files on the server, which can lead to sensitive information disclosure or code execution depending on the context.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized code execution, and disruption of service on affected systems running vulnerable versions of SEOPress for MainWP. The CVSS score of 7.5 indicates a high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to the vulnerable plugin and limiting user interaction with untrusted content may reduce risk.