The vulnerability CVE-2025-68067 in Select-Themes Stockholm Core arises from improper validation of filenames used in PHP include or require statements, enabling PHP Local File Inclusion. This can be exploited by an attacker with limited privileges to include arbitrary local files, potentially leading to disclosure of sensitive information, code execution, or denial of service. The affected versions are all versions up to and including 2.4.6. The CVSS v3.1 base score is 7.5, reflecting network attack vector, high impact on confidentiality, integrity, and availability, but requiring high attack complexity and low privileges without user interaction. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this vulnerability can lead to local file inclusion, which may allow attackers to read sensitive files, execute arbitrary code, or cause denial of service. The CVSS score of 7.5 indicates a high impact on confidentiality, integrity, and availability. However, exploitation requires network access, low privileges, and high attack complexity. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected application and monitor for suspicious activity related to file inclusion attempts. Avoid exposing the vulnerable plugin to untrusted users. Do not rely on generic mitigations unless specifically recommended by the vendor.