The vulnerability CVE-2025-58893 in axiomthemes Alright (<= 1.6.1) is caused by improper validation or control of filenames used in PHP include/require statements, which enables PHP Local File Inclusion. This can allow attackers to include arbitrary files on the server, potentially leading to remote code execution or data disclosure. The CVSS v3.1 score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector and no privileges or user interaction required. No patch or vendor advisory is currently provided, and no known exploits have been reported.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The high CVSS score (8.1) indicates critical impact on confidentiality, integrity, and availability. Since it is a local file inclusion vulnerability, attackers may leverage it to execute arbitrary code or access sensitive files on the server.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should restrict access to vulnerable versions and consider disabling or restricting the affected functionality if possible. Monitor vendor communications for updates and apply patches promptly once released.