The vulnerability CVE-2025-28888 affects BZOTheme's GiftXtore product, specifically versions before 1.7.7. It arises from improper control over the filename parameter used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include arbitrary files on the server, potentially leading to remote code execution or disclosure of sensitive information. The CVSS v3.1 score is 8.1, indicating a high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. An attacker could potentially execute arbitrary code or access sensitive files on the server running the vulnerable GiftXtore versions prior to 1.7.7. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor BZOTheme's official channels for updates. Until a fix is available, restricting access to the vulnerable application and applying web application firewall rules to block malicious requests targeting file inclusion may help mitigate risk.