The vulnerability CVE-2025-49935 in xtemos WoodMart arises from improper validation or control of filenames used in PHP include or require statements, resulting in a Local File Inclusion issue. This can allow an attacker with limited privileges to include unintended files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The affected versions are all versions before 8.3.2. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to disclosure of sensitive files, unauthorized code execution, and disruption of service on the affected system. The high CVSS score reflects the potential for significant impact on confidentiality, integrity, and availability of the affected system. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — no official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates and apply any official fixes once released. Until a patch is available, restricting access to vulnerable endpoints and applying web application firewall rules to detect and block suspicious include/require requests may help reduce risk.