This vulnerability (CVE-2025-26735) in Candid themes Grip arises from improper validation or control of filenames used in PHP include or require statements, categorized under CWE-98. This allows remote attackers to perform remote file inclusion, potentially executing arbitrary code on the affected system. The issue affects versions up to 1.0.9. The CVSS 3.1 base score is 7.5 with vector AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating network attack vector, high attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or official fix has been documented in the provided data.

Successful exploitation of this vulnerability could lead to remote code execution by including malicious files, compromising system confidentiality, integrity, and availability. The high CVSS score reflects the potential severity of impact. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting the use of vulnerable PHP include/require functionality in the affected theme or implement input validation controls to prevent malicious filename inputs. Monitor vendor channels for updates.