The vulnerability CVE-2025-53198 in favethemes Houzez (<= 4.0.4) arises from improper validation or control of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can allow attackers to include local files on the server, potentially leading to disclosure of sensitive information or remote code execution depending on the context. The CVSS 3.1 vector indicates the attack is network-based, requires high complexity, no privileges, and no user interaction, with high impact on confidentiality, integrity, and availability. No patch or official remediation guidance is currently documented.

Successful exploitation could lead to unauthorized inclusion of local files on the server, which may expose sensitive data, enable code execution, or disrupt service availability. The high CVSS score reflects significant risk to confidentiality, integrity, and availability of affected systems running vulnerable versions of Houzez. No known active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected theme version or applying custom mitigations such as restricting file inclusion paths if feasible. Monitor official favethemes communications for updates.