The vulnerability CVE-2025-52816 affects the themehunk Zita WordPress theme (versions up to 1.6.5) and is characterized by improper control over the filename parameter used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, where an attacker can cause the application to include files from the local filesystem. The CVSS 3.1 base score is 8.1, reflecting high impact with network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The vulnerability was published on June 27, 2025, and is currently in a published state with no known exploits or official patches documented.

Successful exploitation of this vulnerability can allow an attacker to include arbitrary local files on the server, potentially leading to disclosure of sensitive information, code execution, or denial of service. The CVSS score of 8.1 indicates a high impact on confidentiality, integrity, and availability. There are no known exploits in the wild, but the vulnerability poses a significant risk if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme or restricting access to vulnerable endpoints if possible. Monitor themehunk's official channels for updates and apply patches promptly when available.