The RadiusTheme Widget for Google Reviews (business-reviews-wp) up to version 1.0.15 contains a PHP Local File Inclusion vulnerability due to improper control of filenames in include/require statements. This vulnerability (CVE-2025-53565) allows remote attackers to include local files on the server, potentially leading to arbitrary code execution. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. The vulnerability is network exploitable without privileges or user interaction but requires high attack complexity. No patch or official fix has been documented in the provided data.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include and execute arbitrary local files on the server running the vulnerable widget. This can lead to full system compromise, including disclosure of sensitive information, modification of data, and denial of service. The high CVSS score reflects the critical nature of these impacts. However, no known exploits are reported in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable widget to prevent exploitation. Monitoring vendor channels for updates is recommended. No vendor advisory or patch links are currently available.