The vulnerability CVE-2025-58948 affects the Aromatica theme by axiomthemes, where improper validation or control of filenames in PHP include or require statements allows local file inclusion. This can enable attackers to execute arbitrary code or access sensitive files on the server. The issue impacts versions up to 1.8. The CVSS 3.1 score of 8.1 reflects high confidentiality, integrity, and availability impact, with network attack vector but high attack complexity and no privileges required. No patch or official remediation is currently documented, and no exploits are known in the wild.

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to include local files on the server, potentially leading to arbitrary code execution, data disclosure, or denial of service. The high CVSS score indicates a significant risk to affected systems. However, the attack complexity is high, which may limit exploitability. There are no known active exploits reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme if possible, or restrict access to vulnerable endpoints. Monitor official axiomthemes communications for updates and apply patches promptly once available.