The vulnerability CVE-2025-60248 in WPClever WPC Product Options for WooCommerce (<= 3.1.3) is due to improper control of filenames in PHP include/require statements, resulting in a PHP Local File Inclusion issue. This allows an attacker with low privileges to potentially include and execute local files on the server, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges without user interaction. No patch or vendor advisory is currently provided, and the product is not a cloud service, so remediation depends on vendor updates.

Successful exploitation could lead to arbitrary code execution or unauthorized access to sensitive files on the server hosting the vulnerable plugin. This impacts the confidentiality, integrity, and availability of the affected system. The vulnerability requires network access and low privileges but no user interaction. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the affected plugin or disabling it if possible. Monitor vendor communications for patches or updates addressing this vulnerability.