The vulnerability CVE-2025-58958 affects ThemeMove SmilePure theme versions before 1.8.5. It arises from improper validation or control of filenames passed to PHP include or require statements, enabling local file inclusion. This can allow an attacker to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability. No vendor advisory or patch links are currently available, and the product is not a cloud service.

Successful exploitation of this vulnerability could lead to remote code execution or disclosure of sensitive information by including local files on the server. This compromises the confidentiality, integrity, and availability of the affected system. Given the high CVSS score, the impact is considered severe.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the vulnerable theme or applying custom code-level mitigations to validate and sanitize inputs to include/require statements. Monitor official ThemeMove communications for updates.