This vulnerability (CVE-2025-58024) in UnboundStudio Accordion FAQ arises from improper validation of filenames in PHP include/require statements, categorized under CWE-98. It allows PHP Local File Inclusion, which can lead to remote code execution or disclosure of sensitive files. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring high attack complexity and low privileges without user interaction. The affected product versions include all up to 2.2.1. No patch or official remediation has been published yet.

Successful exploitation can lead to full compromise of the affected system's confidentiality, integrity, and availability due to local file inclusion. Attackers may execute arbitrary code or access sensitive files. The vulnerability requires network access and low privileges but has high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the vulnerable application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the Accordion FAQ plugin to untrusted users or networks.