The7 WordPress theme by Dream-Theme contains a vulnerability identified as CVE-2025-63074 involving improper control of filenames in PHP include/require statements. This vulnerability allows PHP Local File Inclusion, which can lead to execution of arbitrary local files. It affects versions prior to 12.8.1.1. The CVSS 3.1 base score is 7.5, with network attack vector, high complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. No patch or official fix details are provided in the source data.

Successful exploitation of this vulnerability could allow an attacker to include and execute local files on the server running the vulnerable The7 theme, potentially leading to disclosure of sensitive information, modification of data, or denial of service. The high CVSS score reflects significant potential impact on confidentiality, integrity, and availability. However, no known exploits have been reported in the wild so far.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor Dream-Theme's official channels for updates. Until a fix is available, consider disabling or removing the vulnerable theme or restricting access to the affected system to trusted users only.