This vulnerability (CVE-2025-15637) in Edge Themes Shuffle (versions <= 1.8) is an unauthenticated Local File Inclusion (LFI) issue caused by improper control of filenames used in PHP include/require statements (CWE-98). An attacker can exploit this flaw to include arbitrary local files on the server, which may lead to remote code execution or disclosure of sensitive information. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No official patch or remediation guidance is currently available, and no known exploits in the wild have been reported.

Successful exploitation allows an unauthenticated attacker to include local files on the server, potentially leading to remote code execution, data disclosure, and full system compromise. The vulnerability affects confidentiality, integrity, and availability with high impact as indicated by the CVSS score of 8.1.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the application to untrusted networks if possible.