The vulnerability CVE-2025-39360 affects the everestthemes Grace Mag WordPress theme (versions <= 1.1.5). It arises from improper control over the filename parameter used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow an attacker to include and execute arbitrary files on the server, potentially leading to full compromise of the affected system. The CVSS 3.1 base score is 7.5, reflecting a high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring user interaction with high attack complexity.

Successful exploitation of this vulnerability can lead to unauthorized disclosure of sensitive information, modification of data, and disruption of service on the affected system. The attacker could execute arbitrary code by including local files, potentially resulting in full system compromise. The vulnerability is rated high severity with a CVSS score of 7.5, indicating significant risk to affected deployments.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid deploying or should upgrade from affected versions (<= 1.1.5) of Grace Mag. Applying strict input validation or disabling vulnerable functionality may reduce risk, but official remediation from the vendor is recommended once available.