The vulnerability CVE-2025-68841 in Themepul's TopperPack plugin arises from improper validation of filenames used in PHP include or require statements. This flaw allows an attacker to perform PHP Local File Inclusion, potentially enabling unauthorized access to sensitive files or code execution within the affected application. The issue affects versions up to 1.2.1. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high complexity, no privileges required, user interaction required, and high impact on confidentiality, integrity, and availability. No official patch or vendor advisory is available to confirm remediation status.

Successful exploitation could lead to disclosure of sensitive information, modification of application behavior, or denial of service due to the high impact on confidentiality, integrity, and availability. However, no known exploits are reported in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor Themepul's communications for updates. Until a fix is available, consider restricting access to the affected plugin and limiting user interaction that could trigger the vulnerability.