CVE-2025-7650 is a Local File Inclusion vulnerability (CWE-98) in the BizCalendar Web WordPress plugin. The flaw exists in the handling of the 'bizcalv' shortcode, allowing authenticated attackers with Contributor or higher privileges to include arbitrary files on the server. This can lead to execution of arbitrary PHP code, enabling privilege escalation, data disclosure, or remote code execution. The vulnerability affects all versions up to and including 1.1.0.53. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring low privileges but high attack complexity.

Successful exploitation allows authenticated users with Contributor-level access to execute arbitrary PHP code on the server. This can result in bypassing access controls, unauthorized data access, and full code execution, compromising the integrity, confidentiality, and availability of the affected system.

No official patch or remediation guidance is currently available. Users should restrict Contributor-level access until a fix is released. Monitor the vendor's advisory channels for updates and apply patches promptly once available. Avoid uploading or including files that could be executed as PHP code as a temporary mitigation.