The vulnerability CVE-2025-28945 affects the snstheme Valen WordPress theme up to version 2.4. It is caused by improper validation or control of filenames used in PHP include or require statements, enabling remote file inclusion. This can allow an unauthenticated attacker to execute arbitrary PHP code remotely by including malicious files. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, no privileges, and no user interaction, and impacts confidentiality, integrity, and availability at a high level. No patch or vendor advisory is currently available, and the theme is not a cloud service.

Successful exploitation of this vulnerability can lead to remote code execution on the affected server, allowing attackers to compromise the confidentiality, integrity, and availability of the system hosting the WordPress site. This could result in full system takeover, data theft, defacement, or service disruption. The high CVSS score reflects the severity of these impacts. There are no reports of active exploitation in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable theme or restricting access to vulnerable endpoints. Monitoring for updates from the vendor or trusted security sources is recommended. No official patch or temporary fix is currently documented.