The vulnerability CVE-2025-69383 in WP shop plugin arises from improper validation of filenames used in PHP include or require statements, enabling local file inclusion. This flaw exists in versions up to 2.6.1 and allows an attacker to cause the application to include unintended local files, which may lead to disclosure of sensitive information or code execution. The CVSS v3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and user interaction required.

Successful exploitation can lead to disclosure of sensitive files, modification of application behavior, or denial of service, impacting confidentiality, integrity, and availability of the affected system. The vulnerability is rated high severity with a CVSS score of 7.5. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor vendor communications for updates. Until a fix is available, restricting access to vulnerable endpoints and minimizing user interaction with untrusted inputs may reduce risk.