This vulnerability (CVE-2025-68063) is a Local File Inclusion (LFI) flaw in the Splash - Sport Club WordPress Theme for Basketball, Football, Hockey by StylemixThemes. It arises from improper control of filenames used in PHP include or require statements, allowing an attacker to include unintended local files. The issue affects versions up to 4.4.3. The CVSS 3.1 base score is 7.5, indicating high severity with network attack vector, high complexity, low privileges required, no user interaction, and impacts on confidentiality, integrity, and availability. No patch or official remediation has been published yet.

Successful exploitation of this vulnerability can lead to disclosure of sensitive information, modification of application behavior, and potential denial of service due to inclusion of arbitrary local files. The attacker requires low privileges but must overcome high attack complexity. The vulnerability impacts confidentiality, integrity, and availability of the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or removing the vulnerable theme or applying custom mitigations to restrict file inclusion paths if feasible.