The vulnerability CVE-2025-69375 affects SolverWp Portfolio Builder versions up to 1.2.5. It arises from improper control of the filename parameter used in PHP include or require statements, resulting in PHP Local File Inclusion. This can allow an attacker to execute arbitrary local files on the affected system, impacting confidentiality, integrity, and availability. The CVSS 3.1 base score is 8.1 with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is currently available.

Successful exploitation of this vulnerability could allow an attacker to include and execute local files on the server running the vulnerable Portfolio Builder plugin. This can lead to disclosure of sensitive information, modification of data, and disruption of service. The high CVSS score reflects the potential for severe impact on the affected system's confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable Portfolio Builder plugin to mitigate risk. Avoid exposing the affected application to untrusted networks or users. Monitor vendor channels for updates or patches addressing this vulnerability.