The vulnerability CVE-2025-52816 affects the themehunk Zita WordPress theme versions up to 1.6.5. It is caused by improper control of the filename parameter used in PHP include or require statements, which leads to a Local File Inclusion vulnerability. This allows an attacker to include files from the local filesystem, potentially executing arbitrary code or accessing sensitive information. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with an attack vector over the network and no privileges or user interaction required. The vulnerability is published and tracked but currently lacks a known patch or vendor advisory detailing remediation steps.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary PHP code on the affected server by including local files, leading to full compromise of the system's confidentiality, integrity, and availability. This could result in unauthorized data access, data modification, or denial of service. The high CVSS score (8.1) confirms the critical nature of the impact. No known exploits have been reported in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or replacing the affected theme to mitigate risk. Monitoring for updates from themehunk and applying patches promptly once available is recommended. No vendor advisory or patch links are currently provided.