The vulnerability CVE-2025-60153 affects the wpshuffle Subscribe To Unlock WordPress plugin up to version 1.1.5. It arises from improper control of the filename parameter used in PHP include or require statements, enabling a Local File Inclusion (LFI) attack. This can allow an attacker with low privileges to include arbitrary files on the server, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, and impacts confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could include local files on the server, potentially executing arbitrary code or accessing sensitive data. This poses a significant risk to systems running vulnerable versions of the plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the vulnerable plugin and consider disabling or removing it if possible. Monitor vendor channels for updates and apply patches promptly once available.