The vulnerability CVE-2025-68841 in Themepul TopperPack – Complete Elementor Addons, Theme & CPT Builder arises from improper control of filenames in PHP include or require statements. This flaw allows an attacker to perform PHP Local File Inclusion, potentially enabling unauthorized file access or code execution within affected versions up to 1.2.1. The CVSS 3.1 base score is 7.5, reflecting network attack vector, high attack complexity, no privileges required, user interaction needed, and high impact on confidentiality, integrity, and availability. No vendor advisory or patch information is currently available.

Successful exploitation of this vulnerability could allow an attacker to include local files on the server, potentially leading to disclosure of sensitive information, code execution, or disruption of service. The CVSS score of 7.5 indicates a high impact on confidentiality, integrity, and availability. However, exploitation requires user interaction and has high attack complexity, which may limit the ease of exploitation. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or workaround information is provided, users should monitor Themepul's communications for updates. Until a fix is available, consider restricting access to the affected plugin and limiting user interactions that could trigger the vulnerability.