The vulnerability CVE-2025-48338 affects the WP Abstracts plugin by Kevon Adonis, specifically in the wp-abstracts-manuscripts-manager component. It arises from improper validation or control of filenames used in PHP include or require statements, leading to a Local File Inclusion (LFI) issue. This can allow attackers to execute arbitrary code or access sensitive files on the server. The affected versions are up to and including 2.7.4. The CVSS 3.1 vector indicates the attack requires network access, has high complexity, no privileges, and requires user interaction, but results in high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to arbitrary code execution or unauthorized disclosure of sensitive files on the affected server, compromising confidentiality, integrity, and availability of the system. The high CVSS score reflects the severity of these impacts. However, no known exploits have been reported in the wild, which may indicate limited active exploitation currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the vulnerable plugin or disabling it if feasible to reduce exposure.