The vulnerability CVE-2025-69071 in AncoraThemes TanTum arises from improper validation of filenames used in PHP include or require statements. This flaw enables PHP Local File Inclusion, where an attacker can manipulate the filename parameter to include unintended files on the server. The affected versions are from initial releases through 1.1.13. The CVSS v3.1 base score is 8.1, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, and high impact on confidentiality, integrity, and availability.

Successful exploitation of this vulnerability can lead to unauthorized local file inclusion, potentially allowing attackers to read sensitive files, execute arbitrary code, or cause denial of service. The impact is rated high due to the potential for full system compromise. There are no known exploits in the wild currently.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix links are provided, users should monitor AncoraThemes' official channels for updates. Until a fix is available, consider disabling or removing the affected TanTum theme to mitigate risk.