The vulnerability CVE-2025-60197 affects the Simple Contact Forms plugin by owenr88, specifically versions up to 1.6.4. It arises from improper validation or control of filenames used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This can allow an attacker to include and execute files on the server, potentially leading to remote code execution or data disclosure. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges or user interaction required, and high impact on confidentiality, integrity, and availability. There is no indication of a patch or official remediation at this time.

Successful exploitation of this vulnerability can lead to remote code execution or unauthorized disclosure of sensitive files on the affected server. The attacker can leverage the Local File Inclusion flaw to execute arbitrary PHP code or access configuration and data files, severely compromising the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable Simple Contact Forms plugin or applying manual code review and hardening to prevent untrusted input from controlling include/require filenames. Monitor vendor channels for updates and apply patches promptly once available.