The vulnerability CVE-2025-58945 in axiomthemes EcoGrow (<= 1.7) is due to improper control of filenames in PHP include/require statements, causing a Local File Inclusion (LFI) flaw. This allows an attacker to include arbitrary local files on the server, which can lead to disclosure of sensitive information, code execution, or denial of service. The CVSS v3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and requiring no privileges or user interaction but with high attack complexity.

Successful exploitation of this vulnerability can lead to full compromise of the affected system's confidentiality, integrity, and availability. Attackers may read sensitive files, execute arbitrary code, or cause denial of service. The vulnerability is remotely exploitable without authentication but requires high attack complexity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider applying temporary mitigations such as disabling vulnerable functionality or restricting access to affected components. Monitor vendor channels for updates and apply patches promptly once released.