The vulnerability CVE-2025-58206 in ThemeMove MaxCoach theme versions up to 3.2.5 is caused by improper validation of filenames used in PHP include or require statements. This allows remote attackers to perform Remote File Inclusion (RFI), executing arbitrary PHP code by including malicious remote files. The CVSS 3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. The issue is classified as a PHP Remote File Inclusion vulnerability, which can lead to full system compromise if exploited. No patch or official remediation guidance is currently available from the vendor or other authoritative sources.

Successful exploitation of this vulnerability can lead to remote code execution on the affected system, allowing attackers to execute arbitrary PHP code, potentially resulting in full system compromise including data theft, data modification, or service disruption. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability of the affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme version or applying custom mitigations such as restricting external URL inclusion via web application firewall rules or PHP configuration. Monitor official ThemeMove communications for updates and apply patches promptly once available.