This vulnerability (CVE-2025-62066) affects the Revolution product by fuelthemes, specifically versions before 2.5.8. It is caused by improper validation or control of filenames used in PHP include or require statements, enabling remote file inclusion. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, high attack complexity, low privileges required, no user interaction, and impacts to confidentiality, integrity, and availability. The vulnerability allows an attacker to remotely include and execute arbitrary code via crafted input controlling the filename parameter.

Successful exploitation could lead to remote code execution, allowing attackers to compromise the affected system's confidentiality, integrity, and availability. This could result in unauthorized data access, modification, or service disruption. The vulnerability requires low privileges but has high attack complexity, reducing the likelihood of trivial exploitation. No known active exploits have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vulnerability affects versions prior to 2.5.8, upgrading to version 2.5.8 or later may address the issue if the vendor has released a fix. Until official guidance is available, restrict access to vulnerable installations and validate or sanitize inputs controlling include/require filenames to mitigate risk.