The vulnerability CVE-2025-54700 in ThemeMove Makeaholic theme arises from improper control over the filename parameter used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, allowing attackers to include and execute arbitrary files on the server. The issue affects all versions up to 1.8.4. The CVSS 3.1 score of 8.1 reflects high impact on confidentiality, integrity, and availability, with network attack vector, no privileges required, and no user interaction needed, but with high attack complexity. No patch or official remediation guidance is currently provided by the vendor, and no exploits are known in the wild at this time.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, and full compromise of the affected system's confidentiality, integrity, and availability. The high CVSS score indicates a serious risk if exploited. However, no known active exploitation has been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or replacing the affected theme to mitigate risk. Monitor ThemeMove's official channels for updates or patches addressing this vulnerability.