The vulnerability CVE-2025-67529 affects Opal_WP's Fashion plugin for WordPress prior to version 5.3.0. It arises from improper validation or control of filenames used in PHP include or require statements, leading to a Local File Inclusion (LFI) vulnerability. This can allow an attacker with low privileges to include arbitrary files on the server, potentially resulting in code execution or disclosure of sensitive information. The CVSS score of 7.5 reflects a network attack vector with high impact on confidentiality, integrity, and availability, though it requires high attack complexity and low privileges without user interaction.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive files, remote code execution, and disruption of service on affected installations of the Fashion plugin before version 5.3.0. The attacker needs low privileges but must overcome high attack complexity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor Opal_WP's official channels for updates. Until a patch is available, restricting access to the vulnerable plugin and limiting file inclusion capabilities at the server configuration level may reduce risk.