This vulnerability (CVE-2025-62868) in the Edge-Themes Edge CPT plugin arises from improper control of filenames used in PHP include or require statements, classified under CWE-98. It allows an attacker to perform PHP Local File Inclusion, potentially enabling execution of arbitrary code or disclosure of sensitive files. The affected versions include all versions up to 1.4. The CVSS v3.1 base score is 8.1, reflecting high impact with network attack vector, high complexity, no privileges required, no user interaction, and full confidentiality, integrity, and availability impact. No patch or official fix has been disclosed yet.

Successful exploitation can lead to local file inclusion, allowing attackers to execute arbitrary PHP code or access sensitive files on the server. This compromises confidentiality, integrity, and availability of the affected system. Given the high CVSS score and the nature of the vulnerability, the impact is severe if exploited.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the Edge CPT plugin if possible or restrict access to vulnerable endpoints. Monitor vendor channels for updates and apply patches promptly once released.