The vulnerability CVE-2025-49036 affects Premium Addons for KingComposer by octagonwebstudio, allowing improper control over the filename used in PHP include or require statements. This can lead to PHP Local File Inclusion, where an attacker might include unintended files on the server, potentially leading to code execution or information disclosure. The affected versions include all releases up to and including 1.1.1. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector and no privileges required.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include local files on the server, which may lead to arbitrary code execution, data disclosure, or denial of service. The high CVSS score indicates that confidentiality, integrity, and availability of the affected system can be severely impacted.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor octagonwebstudio's communications for updates. Until a fix is available, consider restricting access to vulnerable components and applying application-level controls to limit file inclusion risks.