The vulnerability CVE-2025-68563 affects the WP Shuffle Subscribe to Unlock Lite WordPress plugin up to version 1.3.0. It arises from improper validation or control of filenames used in PHP include or require statements, enabling a Local File Inclusion attack. This can allow an attacker with limited privileges to include arbitrary local files on the server, potentially leading to remote code execution or data disclosure. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring high attack complexity and low privileges without user interaction. No patch or vendor advisory is currently available, and no known exploits have been reported.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or disrupt service. The CVSS score of 7.5 indicates a high impact on confidentiality, integrity, and availability. However, exploitation requires network access with low privileges and has high attack complexity. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version to mitigate risk. Monitor official WP Shuffle channels or security advisories for updates regarding patches or mitigations.