The vulnerability CVE-2025-62010 in ApusTheme Famita arises from improper validation of filenames in PHP include/require statements, enabling local file inclusion. This can be exploited remotely without authentication, as indicated by the CVSS vector (AV:N/AC:H/PR:N/UI:N). The impact includes high confidentiality, integrity, and availability loss. The affected versions include all releases up to and including 1.54. No vendor advisory or patch links are available at this time, and the vulnerability was published on 2025-11-06.

Successful exploitation allows an unauthenticated remote attacker to include local files on the server, potentially leading to arbitrary code execution, data disclosure, or denial of service. The CVSS score of 8.1 reflects high impact on confidentiality, integrity, and availability. There are no known exploits in the wild as of the publication date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme or applying manual code review and hardening to prevent local file inclusion. Monitor the vendor's channels for updates and patches.