The vulnerability CVE-2025-64193 in 8theme XStore arises from improper control of the filename parameter in PHP include or require statements, resulting in a PHP Local File Inclusion issue. This allows an attacker with low privileges and no user interaction to potentially include arbitrary files on the server, leading to high impact on confidentiality, integrity, and availability. The vulnerability affects versions of XStore prior to 9.6.1. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, low privileges required, no user interaction, and high impact on all three security properties.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, modification of application data, and disruption of service. Given the high CVSS score and the nature of Local File Inclusion, attackers could execute arbitrary code or access sensitive files on the server, severely compromising the affected system.

Patch status is not yet confirmed — no official patch or remediation guidance is provided in the available data. Users should monitor the vendor's advisories for updates and apply any official fixes once released. Until then, restricting access to vulnerable endpoints and validating or sanitizing input parameters related to file inclusion may reduce risk.