CVE-2025-28947 describes a vulnerability in the snstheme MBStore - Digital WooCommerce WordPress Theme (versions up to 2.3) where improper control of the filename parameter in PHP include/require statements allows local file inclusion. This flaw can enable attackers to execute arbitrary local files, potentially compromising the system. The vulnerability is rated high severity with a CVSS 3.1 score of 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official remediation is currently documented, and no exploits are known in the wild.

Successful exploitation of this vulnerability could allow an attacker to include and execute arbitrary local files on the affected server, potentially leading to full system compromise including disclosure of sensitive information, modification of data, or denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. However, there are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting the vulnerable theme, applying access controls to limit file inclusion risks, and monitoring for unusual activity related to file inclusion attempts. Avoid using untrusted input in include/require statements as a temporary mitigation.