The vulnerability CVE-2025-28990 in SNS Vicky theme arises from improper validation or control of filenames used in PHP include or require statements. This flaw allows an attacker to perform PHP Local File Inclusion, potentially executing arbitrary code or accessing sensitive files on the affected system. The issue affects SNS Vicky versions up to 3.7. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to unauthorized local file inclusion, which may result in disclosure of sensitive information, code execution, and full compromise of the affected system's confidentiality, integrity, and availability. Given the high CVSS score, the impact is significant. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — no official fix or patch links are provided in the available data. Users of SNS Vicky theme should monitor the vendor's advisory channels for updates and apply any official patches once released. Until a patch is available, restricting access to vulnerable endpoints and applying web application firewall rules to detect and block suspicious include/require requests may help reduce risk.