The vulnerability CVE-2025-52806 affects the eyecix JobSearch WordPress plugin (versions before 3.0.8) and is characterized by improper control of filenames in PHP include/require statements. This results in a PHP Local File Inclusion vulnerability, which can be exploited to include unintended files on the server. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, high complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability could lead to unauthorized disclosure of sensitive information, modification of data, and disruption of service within the affected JobSearch plugin environment. The attacker requires low privileges but must overcome high attack complexity. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the eyecix vendor advisories for updates. Until a fix is available, consider restricting access to the affected plugin files and limiting privileges of users to reduce risk.