The vulnerability CVE-2025-48290 affects the bslthemes Kinsley WordPress theme versions up to 3.4.4. It arises from improper validation or control of filenames used in PHP include or require statements, which can be exploited to perform Local File Inclusion (LFI). This allows an attacker to include files from the local filesystem, potentially leading to remote code execution or disclosure of sensitive information. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability is published and assigned by Patchstack, but no patch or vendor advisory is currently provided.

Successful exploitation of this vulnerability can lead to local file inclusion, enabling attackers to execute arbitrary code, disclose sensitive files, or disrupt service on the affected system. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. There are no known exploits in the wild currently, but the vulnerability poses a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme version or applying manual code review and hardening to prevent inclusion of untrusted files. Monitor official bslthemes communications for updates on patches or mitigations.