The vulnerability CVE-2025-60074 affects the Processby Lazy Load Optimizer plugin up to version 1.4.7. It arises from improper control of filenames in PHP include or require statements, enabling a PHP Local File Inclusion attack. This can allow an attacker to include and execute arbitrary local files on the server, potentially leading to full compromise of the affected system. The CVSS score is 7.5 (high), with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, modification of data, and disruption of service on the affected system. Because it is a local file inclusion vulnerability, attackers may execute arbitrary code or access sensitive files on the server hosting the Lazy Load Optimizer plugin. The high CVSS score reflects the significant potential impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — no official patch or remediation guidance is currently available from the vendor. Users should monitor the vendor's advisory channels for updates and apply any official fixes once released. Until then, consider restricting access to the affected plugin files and limiting user interaction that could trigger the vulnerability. Avoid exposing the vulnerable plugin to untrusted users or networks.