This vulnerability (CVE-2025-60218) affects WPLocker PT Luxa Addons up to version 1.2.2 and involves an unrestricted file upload flaw (CWE-434). Subscribers can upload files of dangerous types without validation or restriction, potentially enabling remote code execution or other severe impacts. The CVSS v3.1 base score is 9.9, reflecting network attack vector, low attack complexity, low privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported, and no official remediation or patch is currently documented.

Successful exploitation allows an attacker with subscriber-level privileges to upload arbitrary files, including potentially malicious executable code. This can lead to full system compromise, including unauthorized data access, modification, and denial of service. The vulnerability impacts confidentiality, integrity, and availability at a critical level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict subscriber file upload permissions where possible and monitor for suspicious activity related to file uploads. Avoid granting unnecessary file upload privileges to subscribers.