The vulnerability CVE-2025-69066 affects the AncoraThemes Indoor Plants plugin for WordPress up to version 1.2.7. It arises from improper validation or control of filenames used in PHP include or require statements, enabling local file inclusion (LFI). This can allow an attacker to include arbitrary files on the server, potentially leading to remote code execution. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented in the provided data. The vulnerability is not related to a cloud service and no exploits are known in the wild at this time.

Successful exploitation of this vulnerability can result in an attacker including arbitrary local files on the server, which may lead to remote code execution, full system compromise, or data disclosure. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability of the affected system. Since the plugin is used in WordPress environments, exploitation could affect website functionality and security.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version to prevent exploitation. Monitoring for updates from AncoraThemes and applying patches promptly once available is recommended.