CVE-2025-60201 describes a PHP Local File Inclusion vulnerability in the WP Customer Area plugin by aguilatechnologies, present in versions up to 8.3.5. The issue arises from improper validation or control of filenames used in PHP include or require statements, which can be manipulated to include unintended local files. This can lead to unauthorized access to sensitive files or code execution depending on the context. The vulnerability has a CVSS 3.1 base score of 7.5, reflecting high impact but requiring user interaction and high attack complexity. No patch or official remediation details are currently provided, and no known active exploitation is reported.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server running the vulnerable WP Customer Area plugin. This may lead to disclosure of sensitive information, potential code execution, or other impacts affecting confidentiality, integrity, and availability. The CVSS score of 7.5 indicates a high severity impact, but the attack complexity is high and user interaction is required.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is available, users should monitor the vendor's communications for updates. Until a fix is released, consider restricting access to the affected plugin or disabling it if feasible to reduce exposure.