A vulnerability, which was classified as critical, has been found in jwsthemes OchaHouse Plugin up to 2.2.8 on WordPress. Affected by this issue is some unknown functionality. This manipulation causes improper control of filename for include/require statement in php program (‘php remote file inclusion’).
This vulnerability appears as CVE-2025-12550. The attack may be initiated remotely. There is no available exploit.
