The vulnerability identified as CVE-2025-60065 affects the Pinevale theme by axiomthemes, specifically versions up to and including 1.0.14. It arises from improper validation or control of filenames used in PHP include or require statements, leading to a Local File Inclusion (LFI) vulnerability. This can allow an attacker to include files from the server, potentially leading to remote code execution or disclosure of sensitive information. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch links or vendor advisories are currently available, and the product is not a cloud service, so remediation depends on vendor action or user intervention.

Successful exploitation of this vulnerability can lead to the inclusion and execution of arbitrary files on the affected server, compromising confidentiality, integrity, and availability of the system. This may result in unauthorized disclosure of sensitive data, modification of files, or denial of service. The high CVSS score (8.1) reflects these severe potential impacts. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix is currently available, users should monitor axiomthemes' communications for updates. In the meantime, restricting access to the vulnerable application, disabling or limiting PHP include/require functionality where possible, and applying general PHP security best practices may reduce risk. Avoid using affected versions of Pinevale until a fix is released.