The vulnerability CVE-2025-54017 in Cozmoslabs Paid Member Subscriptions plugin arises from improper validation or control of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), potentially executing arbitrary code or accessing sensitive files on the server. The affected versions include all releases up to 2.15.4. The CVSS 3.1 base score is 7.5, indicating a high severity with network attack vector, high attack complexity, no privileges required, user interaction required, and full impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently provided.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or escalate privileges on the affected system. This compromises the confidentiality, integrity, and availability of the system running the vulnerable plugin. Given the high CVSS score and the nature of the vulnerability, the impact is significant for affected installations.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin to mitigate risk. Monitor official Cozmoslabs communications for updates and apply patches promptly once available.