The vulnerability CVE-2025-60071 in don-themes Riode arises from improper validation or control of filenames used in PHP include or require statements. This allows an attacker to perform Local File Inclusion (LFI), where local files on the server can be included and executed by the PHP interpreter. The affected versions are up to and including 1.6.23. The CVSS 3.1 vector indicates the attack requires network access with high attack complexity, no privileges, and no user interaction, and impacts confidentiality, integrity, and availability with high severity.

Successful exploitation of this vulnerability can lead to disclosure of sensitive files, execution of arbitrary code, and full compromise of the affected system's confidentiality, integrity, and availability. Given the high CVSS score and the nature of LFI vulnerabilities, attackers could leverage this flaw to escalate privileges or pivot within the environment.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider restricting access to vulnerable endpoints and applying any available temporary mitigations recommended by the vendor. Monitor vendor channels for updates and apply patches promptly once available.