The vulnerability CVE-2025-52807 affects the ApusWP Kossy WordPress theme up to version 1.45. It is caused by improper validation or control of filenames used in PHP include or require statements, enabling a Local File Inclusion attack. This can allow attackers to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector and no privileges required but high attack complexity. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to full compromise of the affected web server, including unauthorized disclosure of sensitive information, modification of data, and potential denial of service. The attacker can execute arbitrary local files, which may lead to remote code execution depending on the server configuration and available files. The vulnerability affects all installations of the Kossy theme up to version 1.45. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable theme or restricting access to the affected web application to trusted users only. Monitoring for updates from ApusWP or the theme distributor is recommended to apply any forthcoming patches promptly.