The vulnerability CVE-2025-58930 in axiomthemes FitFlex theme arises from improper validation or control of filenames used in PHP include or require statements. This leads to a Local File Inclusion vulnerability, where an attacker can manipulate the filename parameter to include arbitrary local files on the server. Such an inclusion can lead to remote code execution or disclosure of sensitive information. The affected product versions include all versions up to and including 1.6. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector, high attack complexity, no privileges required, and no user interaction needed. No patch or official fix information is currently provided, and no exploits are known in the wild.

Successful exploitation of this vulnerability can lead to arbitrary local file inclusion, which may allow attackers to execute arbitrary code, disclose sensitive information, or disrupt service. The CVSS score of 8.1 indicates high impact on confidentiality, integrity, and availability. Since the vulnerability can be exploited remotely without authentication or user interaction, affected systems are at significant risk until remediated.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected FitFlex theme or applying temporary mitigations such as restricting file inclusion parameters if possible. Monitor official axiomthemes communications for updates and apply patches promptly once available.