The vulnerability CVE-2025-62055 in Elated-Themes Academist theme arises from improper validation of filenames used in PHP include or require statements, enabling remote attackers to perform PHP Remote File Inclusion. This can lead to remote code execution with no privileges or user interaction required. The issue affects versions prior to 1.3. The CVSS v3.1 base score is 8.1, reflecting high impact on confidentiality, integrity, and availability, with network attack vector and high attack complexity.

Successful exploitation of this vulnerability allows an unauthenticated attacker to execute arbitrary PHP code remotely by including malicious files, potentially leading to full system compromise including data theft, modification, or service disruption.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or removing the affected theme or restricting access to vulnerable endpoints to trusted users only.