The vulnerability CVE-2025-49383 affects the CocoBasic Neresa WordPress plugin up to version 1.3. It arises from improper validation or control over filenames used in PHP include or require statements, enabling PHP Local File Inclusion (LFI). This can allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, no privileges, and no user interaction, and impacts confidentiality, integrity, and availability at a high level. No patch or official fix has been documented, and the product is not a cloud service, so remediation depends on vendor updates or user action.

Successful exploitation of this vulnerability can lead to local file inclusion, which may expose sensitive files, enable remote code execution, or disrupt service availability. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. There are no known active exploits reported, but the vulnerability poses a significant risk if leveraged by attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor the vendor's communications for updates. Until a fix is released, consider disabling or removing the affected plugin version to mitigate risk.