The vulnerability CVE-2025-60202 in Kyle Phillips Favorites (<= 2.3.6) arises from improper control over the filename parameter used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, allowing attackers to include and execute arbitrary local files on the server. The CVSS 3.1 vector indicates network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits have been observed.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability by including unauthorized local files. This could allow attackers to execute arbitrary code or access sensitive information stored on the server. The high CVSS score reflects the serious potential impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable functionality and apply strict input validation or sanitization on filename parameters. Monitor vendor channels for updates and patches.