The vulnerability CVE-2025-63003 affects the North - Required Plugin by fuelthemes, allowing an attacker to manipulate the filename parameter in PHP include or require statements improperly. This improper control can lead to Local File Inclusion (LFI), enabling an attacker to include and execute arbitrary files on the server. The affected versions are up to and including 1.4.2. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring low privileges and high attack complexity.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could potentially execute arbitrary code or access sensitive files on the server running the vulnerable plugin. This could result in data breaches, service disruption, or further system compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable plugin to mitigate risk. Monitor official fuelthemes communications for updates on patches or mitigations.