The vulnerability CVE-2025-60059 affects the axiomthemes smart SEO plugin up to version 2.12. It arises from improper control of the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This can allow an unauthenticated remote attacker to include files on the server, potentially leading to remote code execution or information disclosure. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no privileges or user interaction required. No patch or official fix has been disclosed yet.

Successful exploitation of this vulnerability can lead to execution of arbitrary code or disclosure of sensitive information on the affected server. The attacker can include local files via the vulnerable include/require statement, potentially compromising the entire system. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected smart SEO plugin versions or applying manual code review and hardening to prevent untrusted input from controlling include/require filenames.