CVE-2025-31912 describes a PHP Local File Inclusion vulnerability in the gavias Enzio Responsive Business WordPress Theme, caused by improper control of filenames in include or require statements. This flaw allows an attacker to include local files on the server, potentially leading to remote code execution or data disclosure. The issue affects versions prior to 1.2.6. The vulnerability has a CVSS 3.1 base score of 8.1, reflecting high confidentiality, integrity, and availability impacts. No patch or official fix information is currently available from the vendor, and no known exploits have been reported.

Successful exploitation could allow an unauthenticated attacker to include and execute arbitrary local files on the server running the vulnerable theme, leading to full compromise of confidentiality, integrity, and availability of the affected system. This could result in unauthorized data access, code execution, or denial of service.

Patch status is not yet confirmed—check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or replacing the vulnerable theme to mitigate risk. Monitor vendor channels for updates and apply patches promptly once available.