The vulnerability CVE-2025-67934 affects Mikado-Themes Wellspring versions before 2.8 and is caused by improper control of filenames used in PHP include or require statements. This leads to a PHP Local File Inclusion vulnerability, enabling an attacker to include arbitrary local files on the server. The CVSS 3.1 base score is 8.1 with vector AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation allows an unauthenticated attacker to include local files on the server running Wellspring, potentially leading to disclosure of sensitive information, modification of data, or disruption of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should monitor vendor communications for updates. No specific mitigations or workarounds are provided in the available data.