The vulnerability CVE-2025-52812 affects ApusWP Domnoo versions up to 1.49 and is caused by improper control of filenames in PHP include/require statements, resulting in PHP Local File Inclusion. This can allow an attacker to include unintended files on the server, potentially leading to remote code execution or data disclosure. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with a network attack vector but requiring high attack complexity and no privileges or user interaction. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server running ApusWP Domnoo, potentially leading to disclosure of sensitive information, remote code execution, and full system compromise. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor ApusWP communications for updates. Until a fix is available, restricting access to the affected application and applying web application firewall rules to block suspicious requests targeting file inclusion may help reduce risk.