The vulnerability CVE-2025-60046 in axiomthemes HeartStar (<= 1.0.14) is caused by improper control of the filename parameter in PHP include/require statements. This flaw allows PHP Local File Inclusion, which can enable attackers to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 base score is 8.1, indicating high severity with network attack vector, high attack complexity, no privileges required, no user interaction, and impacts to confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to full compromise of the affected system, including unauthorized disclosure of sensitive information, modification of data, and disruption of service. The high CVSS score reflects the critical nature of the impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Until a patch is released, users should consider applying workarounds such as disabling vulnerable functionality or restricting access to affected components if possible.