The vulnerability CVE-2025-58894 affects the axiomthemes Good Mood PHP application through improper control of filenames in include/require statements. This flaw allows local file inclusion (LFI), enabling attackers to include and execute arbitrary files on the server. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, and no privileges or user interaction required. The affected versions are up to 1.16. No patch or official remediation information is currently available.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, unauthorized code execution, and potential full system compromise. The high CVSS score indicates critical impacts on confidentiality, integrity, and availability. No known exploits in the wild have been reported so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any available workarounds recommended by the vendor. Monitor vendor channels for updates and apply patches promptly once available.