The vulnerability CVE-2025-67525 in Opal_WP ekommart arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can be exploited remotely over the network by an attacker with low privileges and no user interaction required. The CVSS v3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability. The affected versions are all prior to 4.3.1, but no patch or official fix details have been provided yet. The vulnerability was published on December 9, 2025, and no known exploits have been reported.

Successful exploitation of this vulnerability could allow an attacker to include arbitrary local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score of 7.5 indicates a high impact on confidentiality, integrity, and availability. However, there are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any available temporary mitigations recommended by the vendor. Monitor vendor channels for updates and apply patches promptly once available.