CVE-2025-15637: CWE-98 Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') in Edge Themes Shuffle

CVE-2025-15637 is a Local File Inclusion vulnerability (CWE-98) in the PHP-based Edge Themes Shuffle product. The vulnerability arises from improper validation of filenames used in include or require statements, enabling unauthenticated attackers to include arbitrary local files. This can lead to remote code execution or disclosure of sensitive information. The vulnerability affects Shuffle versions up to and including 1.8. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability with network attack vector and no privileges or user interaction required.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including disclosure of sensitive files, execution of arbitrary code, and disruption of service. The high CVSS score indicates critical impact on confidentiality, integrity, and availability.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts.