The vulnerability CVE-2025-67521 affects Select-Themes Select Core versions before 2.6. It arises from improper control of the filename parameter in PHP include/require statements, enabling PHP Local File Inclusion. This can allow an attacker with low privileges and no user interaction to execute arbitrary code or access sensitive files on the server. The CVSS 3.1 vector indicates network attack vector, high attack complexity, low privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to local file inclusion, potentially allowing attackers to execute arbitrary code, disclose sensitive information, or disrupt service availability. The impact is rated high due to the potential for full system compromise. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Select-Themes advisories for updates. Until a fix is available, restricting access to vulnerable endpoints and applying strict input validation on filename parameters may reduce risk.