The vulnerability CVE-2025-22707 in ThemeMove Moody theme arises from improper control of filenames in PHP include or require statements, resulting in a Local File Inclusion issue. This allows an attacker to manipulate the filename parameter to include unintended local files on the server. The affected versions are up to and including 2.7.3. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. There is no vendor advisory or patch link currently available, and the product is not a cloud service. No known exploits have been reported in the wild.

Successful exploitation of this vulnerability could allow an attacker to read sensitive local files on the server, potentially disclosing confidential information, and may lead to further compromise affecting system integrity and availability. The high CVSS score reflects the critical nature of these impacts. However, there are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints, applying web application firewall (WAF) rules to detect and block suspicious include/require requests, and limiting file permissions to reduce exposure. Monitor ThemeMove's official channels for updates and apply patches promptly once available.