CVE-2025-12497 is a Local File Inclusion vulnerability in the Premium Portfolio Features for Phlox theme WordPress plugin, affecting all versions up to 2.3.10. The vulnerability arises from improper control of the 'args[extra_template_path]' parameter, allowing unauthenticated attackers to include arbitrary PHP files on the server. Successful exploitation can lead to execution of arbitrary PHP code, enabling attackers to bypass access controls, access sensitive data, or achieve remote code execution if malicious PHP files can be uploaded and included. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or official fix has been documented yet.

Exploitation of this vulnerability allows unauthenticated remote attackers to execute arbitrary PHP code on the affected server. This can result in full compromise of the web server, including bypassing access controls and unauthorized disclosure of sensitive information. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the vulnerable parameter if possible, disable or remove the Premium Portfolio Features for Phlox theme plugin if not required, and monitor for updates from the vendor. Avoid uploading or allowing PHP files that could be included via this vulnerability.