The vulnerability CVE-2025-60203 in Josh Kohlbach Store Exporter (<= 2.7.6) is caused by improper validation of filenames used in PHP include or require statements, resulting in a Local File Inclusion issue. This allows attackers to manipulate the filename parameter to include arbitrary local files on the server. The vulnerability is remotely exploitable over the network but requires user interaction. It has a high CVSS score of 7.5 due to its potential to compromise confidentiality, integrity, and availability of the affected system. No patch or vendor advisory is currently available, and no exploits have been observed in the wild.

Successful exploitation of this vulnerability can lead to local file inclusion, which may expose sensitive files, configuration data, or source code. This can further facilitate privilege escalation or remote code execution depending on the server environment and additional vulnerabilities. The CVSS vector indicates that the attack requires high attack complexity and user interaction but no privileges. The impact is high on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin and avoid exposing it to untrusted users. Monitor for vendor updates and apply patches promptly once released.