The vulnerability CVE-2025-62053 affects the favethemes Houzez product versions before 4.2.0. It is caused by improper validation or control of filenames used in PHP include or require statements, which can be exploited for remote file inclusion. This allows an unauthenticated attacker to execute arbitrary code remotely by including malicious files. The vulnerability has a high CVSS score of 8.1 with network attack vector, high complexity, no privileges required, no user interaction, and impacts confidentiality, integrity, and availability. No patch or official remediation details are currently available from the vendor or other authoritative sources.

Successful exploitation of this vulnerability could lead to remote code execution on the affected system, compromising confidentiality, integrity, and availability of the application and potentially the underlying server. This could allow attackers to execute arbitrary commands, access sensitive data, or disrupt service. However, there are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider applying temporary mitigations such as disabling vulnerable functionality if possible or restricting access to the affected application. Avoid exposing the vulnerable application to untrusted networks. Monitor the vendor's channels for updates and apply official patches promptly once available.