The vulnerability CVE-2025-62054 in the favethemes Houzez Theme - Functionality plugin arises from improper validation or control of filenames used in PHP include or require statements. This flaw enables remote file inclusion, where an attacker can supply a crafted filename to include remote malicious code. The issue affects all versions up to 4.1.8. The CVSS 3.1 base score is 7.5, reflecting a network attack vector, high impact on confidentiality, integrity, and availability, but requiring high attack complexity and low privileges without user interaction. No patch or official remediation details are provided in the available data.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code remotely by including malicious files. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. The attacker requires only low privileges and no user interaction, but the attack complexity is high. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected plugin and consider disabling it if possible. Monitor for updates from the vendor favethemes regarding patches or mitigations for this vulnerability.