The vulnerability CVE-2025-48126 in g5theme Essential Real Estate arises from improper validation or control of filenames used in PHP include/require statements, enabling PHP Local File Inclusion. This allows an attacker to cause the application to load unintended local files, which can lead to arbitrary code execution or disclosure of sensitive information. The issue affects all versions up to 5.2.9. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high impact on confidentiality, integrity, and availability, and no required privileges or user interaction.

Successful exploitation of this vulnerability can lead to local file inclusion, allowing attackers to execute arbitrary code or access sensitive files on the server. This results in a high impact on confidentiality, integrity, and availability of the affected system. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. In the meantime, restricting access to vulnerable endpoints and applying web application firewall rules to detect and block suspicious include/require requests may help mitigate risk.