CVE-2025-39462: 
WordPress vulnerability analysis and mitigation

A Local File Inclusion vulnerability (CVE-2025-39462) was discovered in the teamzt Smart Agreements WordPress plugin affecting versions through 1.0.3. The vulnerability was reported on February 28, 2025, and publicly disclosed on April 17, 2025. The issue is classified as an Improper Control of Filename for Include/Require Statement in PHP Program vulnerability (NVD, Patchstack).

The vulnerability is categorized as CWE-98 (Improper Control of Filename for Include/Require Statement in PHP Program) and has received a CVSS v3.1 base score of 7.5 (High). The CVSS vector string is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating that the vulnerability is network-accessible, requires high attack complexity, needs no privileges, requires user interaction, and can potentially result in high impacts to confidentiality, integrity, and availability (NVD).

The vulnerability could allow an unauthenticated attacker to include local files of the target website and display their contents. This could potentially expose sensitive information, including database credentials, which might lead to complete database compromise depending on the system configuration (Patchstack).

Users are advised to update to version 1.0.4 or later to resolve the vulnerability. Patchstack has issued a virtual patch to mitigate this issue by blocking potential attacks until users can update to the fixed version (Patchstack).