The vulnerability CVE-2025-49372 affects VillaTheme HAPPY versions up to 1.0.7 and is classified as an improper control of code generation, resulting in a remote code inclusion flaw. This allows an attacker to inject and execute arbitrary code remotely without any privileges or user interaction. The CVSS 3.1 base score is 10.0, reflecting its critical nature with network attack vector, low attack complexity, no privileges required, no user interaction, and complete impact on confidentiality, integrity, and availability. The vulnerability is publicly disclosed but lacks vendor-provided patch or mitigation details.

Successful exploitation of this vulnerability can lead to full system compromise, including unauthorized disclosure of information, modification of data, and disruption of service. Given the critical CVSS score and the nature of remote code inclusion, attackers could execute arbitrary code remotely, potentially taking full control of affected systems running VillaTheme HAPPY up to version 1.0.7.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or isolating the affected application to prevent exposure. Monitor official VillaTheme communications for updates on patches or mitigations. No vendor advisory or patch links are currently available.