The vulnerability identified as CVE-2025-69387 affects the Simple Retail Menus plugin by whatwouldjessedo. It arises from improper control over the filename parameter used in PHP include or require statements, resulting in a Local File Inclusion (LFI) vulnerability. This can allow an attacker to include unintended files on the server, potentially leading to code execution or information disclosure. The affected versions include all versions up to and including 4.2.1. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently available.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include local files on the server via the vulnerable PHP include/require statement. This may lead to arbitrary code execution, disclosure of sensitive information, or disruption of service. The high CVSS score reflects the potential for significant impact on confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected Simple Retail Menus plugin version or applying manual code review and hardening to prevent local file inclusion. Avoid exposing the vulnerable plugin to untrusted users or inputs. Monitor vendor channels for updates.