The vulnerability CVE-2025-58944 in axiomthemes Manufactory arises from improper validation or control of filenames used in PHP include or require statements. This flaw allows local file inclusion, where an attacker can cause the application to include unintended files from the local filesystem. The CVSS 3.1 base score is 8.1, indicating high severity, with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability. Affected versions include all versions up to 1.4. No patch or official remediation information is currently available.

Successful exploitation of this vulnerability could allow an attacker to read sensitive files, execute arbitrary code, or disrupt service by including malicious or unintended files. The impact affects confidentiality, integrity, and availability of the affected system. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any available workarounds recommended by the vendor. Monitor official sources for updates.