The vulnerability CVE-2025-32158 affects the aThemes Addons for Elementor plugin up to version 1.1.3. It is caused by improper validation or control of filenames in PHP include or require statements, enabling remote file inclusion. This can allow an attacker to execute arbitrary code remotely by including malicious files. The CVSS v3.1 base score is 7.5, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, low privileges required, and no user interaction needed. The vulnerability is publicly disclosed but lacks an official patch or vendor advisory at this time.

Successful exploitation of this vulnerability can lead to remote code execution, allowing attackers to fully compromise the affected system's confidentiality, integrity, and availability. The attacker requires only low privileges and no user interaction, but must overcome high attack complexity. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected plugin version if possible. Monitor official channels from Syed Balkhi for updates and patches addressing this vulnerability.