The vulnerability CVE-2025-68905 in jegtheme JNews - Pay Writer arises from improper control over the filename parameter used in PHP include or require statements. This allows an attacker with low privileges and no user interaction to perform local file inclusion, potentially leading to disclosure of sensitive files or code execution. The affected versions include all releases up to 11.0.0. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to local file inclusion, which may disclose sensitive information, allow code execution, or disrupt service availability. The high CVSS score reflects the potential for significant impact on system confidentiality, integrity, and availability. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected plugin and applying any recommended temporary mitigations from the vendor. Monitor official jegtheme or JNews communications for updates on patches or workarounds.