The vulnerability CVE-2025-67941 affects the Elated-Themes The Aisle WordPress theme before version 2.9.1. It arises from insufficient validation or control over filenames used in PHP include or require statements, enabling local file inclusion. This can lead to an attacker accessing or executing arbitrary files on the server. The CVSS v3.1 base score is 8.1, indicating high severity with network attack vector, high impact on confidentiality, integrity, and availability, and no privileges or user interaction required. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to include and execute arbitrary local files on the affected server, potentially leading to full system compromise including disclosure of sensitive information, modification of data, and denial of service. The high CVSS score reflects the critical impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the affected theme or applying manual code review and hardening to restrict file inclusion paths. Monitor official Elated-Themes communications for updates.