The vulnerability CVE-2025-32309 in ThemeMove Healsoul theme arises from improper validation or control of filenames used in PHP include or require statements. This enables a PHP Local File Inclusion attack, where an attacker can cause the application to include unintended local files, potentially leading to remote code execution or information disclosure. The issue affects Healsoul versions up to 2.2.3. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with a network attack vector but requiring high attack complexity and no privileges or user interaction. No patch or official vendor advisory is currently available, and no exploits are known in the wild.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to read sensitive files or execute arbitrary code on the affected server. This compromises confidentiality, integrity, and availability of the system running the vulnerable Healsoul theme. The high CVSS score indicates a serious threat if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable theme or applying manual code reviews to restrict file inclusion paths. Monitor ThemeMove’s official channels for updates and apply patches promptly once available.