The vulnerability CVE-2025-58206 affects ThemeMove MaxCoach theme versions up to 3.2.5 and is caused by improper control of filenames in PHP include or require statements. This leads to a PHP Local File Inclusion vulnerability, allowing attackers to include arbitrary files on the server. The CVSS 3.1 score of 8.1 reflects high confidentiality, integrity, and availability impacts, with an attack vector over the network and no privileges or user interaction required. No patch or official fix information is currently provided, and no known exploits have been reported.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service, impacting confidentiality, integrity, and availability of the affected system. The high CVSS score underscores the severity of these impacts. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable theme or applying temporary mitigations if recommended by the vendor. Monitor official ThemeMove communications for updates and patches addressing this vulnerability.