The vulnerability CVE-2025-58973 affects the Easy Elementor Addons plugin by hashthemes, specifically versions up to and including 2.2.8. It stems from improper validation or control of filenames in PHP include or require statements, which enables remote file inclusion. This flaw can be exploited remotely without user interaction but requires low privileges. Exploitation can lead to remote code execution, impacting confidentiality, integrity, and availability of the affected system. The CVSS 3.1 base score is 7.5 with vector AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, reflecting network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability. No patch or vendor advisory is currently provided, and no known exploits have been observed.

Successful exploitation of this vulnerability allows an attacker to remotely include and execute arbitrary PHP code on the affected system. This can lead to full compromise of the system's confidentiality, integrity, and availability. The attacker requires only low privileges and no user interaction, but the attack complexity is high. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Easy Elementor Addons plugin if possible, or restrict access to vulnerable endpoints to trusted users only. Monitor vendor communications for updates and apply patches promptly once released.