The vulnerability CVE-2025-60191 affects Premmerce Wishlist for WooCommerce through improper control of filenames used in PHP include/require statements, resulting in PHP Local File Inclusion. This can allow attackers to include arbitrary files on the server, potentially leading to code execution or data exposure. The issue affects versions up to and including 1.1.10. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official fix information is currently available.

Successful exploitation could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, modification of files, or remote code execution. This impacts confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 7.5. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting use of the affected plugin and monitor for updates from Premmerce. Avoid exposing the affected system to untrusted users or inputs that could trigger the vulnerability.