The vulnerability CVE-2025-60051 affects AncoraThemes Rare Radio up to version 1.0.15.1 and is characterized by improper control over the filename used in PHP include or require statements. This improper control enables PHP Local File Inclusion, allowing an attacker to include arbitrary local files on the server. The vulnerability is remotely exploitable over the network without privileges or user interaction but requires high attack complexity. The impact includes high confidentiality, integrity, and availability loss. There is no vendor advisory or patch information available at this time.

Successful exploitation of this vulnerability can lead to local file inclusion on the server running Rare Radio, potentially allowing attackers to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS score of 8.1 reflects a high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable functionality or applying custom input validation to prevent malicious file inclusion. Monitor official AncoraThemes channels for updates and patches addressing this vulnerability.