The vulnerability CVE-2025-67522 affects NooTheme Jobmonster versions up to 4.8.2 and arises from improper control of filenames used in PHP include or require statements. This improper validation can lead to PHP Local File Inclusion, enabling an attacker with low privileges to include unintended files, potentially resulting in remote code execution or unauthorized data disclosure. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The attacker requires only low privileges and no user interaction, increasing the risk. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the affected application, apply strict input validation on filenames used in include/require statements, and monitor for suspicious activity related to file inclusion attempts.