This vulnerability (CVE-2025-58953) in ThemeREX Joly (<= 1.22.0) is classified as CWE-98, involving improper control of filenames used in PHP include or require statements. It allows unauthenticated attackers to perform local file inclusion, potentially leading to remote code execution or disclosure of sensitive files. The CVSS 3.1 score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No vendor advisory or patch information is provided, and no known exploits are reported in the wild.

Successful exploitation could allow an unauthenticated attacker to include and execute arbitrary files on the server, leading to full compromise of confidentiality, integrity, and availability of the affected system. This can result in remote code execution and unauthorized access to sensitive data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to vulnerable installations and consider disabling or restricting PHP include/require functionality if possible.