The vulnerability CVE-2026-25382 in jwsthemes IdealAuto arises from improper control over the filename parameter used in PHP include or require statements. This improper control allows an attacker to perform Local File Inclusion (LFI), which can lead to unauthorized file access or code execution on the server. The issue affects all versions of IdealAuto before 3.8.6. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service. The high CVSS score indicates significant potential impact on the affected system's confidentiality, integrity, and availability. There are no known exploits in the wild as of the published date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor jwsthemes advisories for updates. Until a fix is available, restricting access to the affected application and validating or sanitizing input parameters related to file inclusion may reduce risk.